feat: album covers with palettes and signed links (M2)

- covers are taken from the embedded picture of the first track or a
  cover/folder/front image in the album folder, converted by ffmpeg to
  WebP 64/300/1200 and named by content hash, so albums sharing a cover
  share the files; a full scan looks again for albums without one
- a 3-colour palette (dominant, second, most saturated accent) from a
  deterministic k-means feeds placeholders, page tints and the wave
- /covers/{id} is public but HMAC-signed and immutable; nginx serves
  the file via X-Accel-Redirect, X_ACCEL=false serves it from api
- the web client picks the size by display size and pixel density
- install.sh and update.sh generate STREAM_SIGNING_KEY

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/platform/config/config.go

@@ -40,6 +40,13 @@ type API struct {
 	InternalToken   string `env:"INTERNAL_TOKEN"`
 	FFprobePath     string `env:"FFPROBE_PATH" envDefault:"ffprobe"`
 
+	// SigningKey — ключ подписи ссылок на обложки и стрим (base64, ≥ 16 байт). Пусто — случайный до перезапуска.
+	SigningKey string `env:"STREAM_SIGNING_KEY"`
+	CacheDir   string `env:"CACHE_DIR" envDefault:"/cache"`
+	FFmpegPath string `env:"FFMPEG_PATH" envDefault:"ffmpeg"`
+	// XAccel — файлы отдаёт nginx по X-Accel-Redirect; false — для запуска api без nginx.
+	XAccel bool `env:"X_ACCEL" envDefault:"true"`
+
 	MeiliURL       string `env:"MEILI_URL" envDefault:"http://meilisearch:7700"`
 	MeiliMasterKey string `env:"MEILI_MASTER_KEY"`
 }