feat: album covers with palettes and signed links (M2)

- covers are taken from the embedded picture of the first track or a
  cover/folder/front image in the album folder, converted by ffmpeg to
  WebP 64/300/1200 and named by content hash, so albums sharing a cover
  share the files; a full scan looks again for albums without one
- a 3-colour palette (dominant, second, most saturated accent) from a
  deterministic k-means feeds placeholders, page tints and the wave
- /covers/{id} is public but HMAC-signed and immutable; nginx serves
  the file via X-Accel-Redirect, X_ACCEL=false serves it from api
- the web client picks the size by display size and pixel density
- install.sh and update.sh generate STREAM_SIGNING_KEY

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/library/scanner.go

@@ -178,6 +178,12 @@ func (sc *Scanner) run(ctx context.Context, src Source, root string, full bool)
 		return fmt.Errorf("library: patterns: %w", err)
 	}
 
+	if full {
+		// Полный скан — повод поискать обложки заново: в папках могли появиться cover.jpg.
+		if err := sc.store.ResetCoverChecks(ctx, src.ID); err != nil {
+			return err
+		}
+	}
 	existing, err := sc.store.Files(ctx, src.ID)
 	if err != nil {
 		return err