feat: album covers with palettes and signed links (M2)

- covers are taken from the embedded picture of the first track or a
  cover/folder/front image in the album folder, converted by ffmpeg to
  WebP 64/300/1200 and named by content hash, so albums sharing a cover
  share the files; a full scan looks again for albums without one
- a 3-colour palette (dominant, second, most saturated accent) from a
  deterministic k-means feeds placeholders, page tints and the wave
- /covers/{id} is public but HMAC-signed and immutable; nginx serves
  the file via X-Accel-Redirect, X_ACCEL=false serves it from api
- the web client picks the size by display size and pixel density
- install.sh and update.sh generate STREAM_SIGNING_KEY

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/auth/middleware.go

@@ -87,7 +87,9 @@ func Middleware(svc *Service, log *slog.Logger) func(http.Handler) http.Handler
 				r.Body = io.NopCloser(strings.NewReader("{}"))
 				r.ContentLength = 2
 			}
-			if !strings.HasPrefix(r.URL.Path, "/api/v1/") || publicRoutes[route] {
+			// Обложки открывает <img> без заголовка Authorization — ссылку защищает подпись.
+			cover := r.Method == http.MethodGet && strings.HasPrefix(r.URL.Path, "/api/v1/covers/")
+			if !strings.HasPrefix(r.URL.Path, "/api/v1/") || publicRoutes[route] || cover {
 				next.ServeHTTP(w, r.WithContext(ctx))
 				return
 			}