feat(rec): audio analyzer and My Wave v1 engine (M4)

- migration 00006: track features and embeddings (pgvector, HNSW),
  analysis queue filled by a trigger on new tracks, wave sessions and
  impressions, recommender profiles, model versions
- analyzer basic-1 (ADR-014): ffmpeg decode, three 30 s excerpts,
  256-d timbre/rhythm embedding, tempo by onset autocorrelation, key,
  loudness, energy, danceability, acousticness, intro length; worker
  with SKIP LOCKED claims, retries and re-analysis on version change
- wave engine v1: candidates (session/taste similarity, fresh,
  liked artists, rediscover, popular, exploration, seed), filters
  (dislikes, played in 3 h, already served), heuristic score, activity
  and mood fit from contexts.yaml with relaxing thresholds, MMR with
  one track per artist, exploration share, session vector updated by
  reactions and a change of course after three skips
- POST /internal/wave/batch with the catalog index cached in memory
  and the session kept in Redis

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/recommender/tests/test_app.py

@@ -57,3 +57,10 @@ def test_internal_status_requires_token() -> None:
     r = c.get("/internal/status", headers={"Authorization": "Bearer secret"})
     assert r.status_code == 200
     assert r.json()["version"] == "1.2.3"
+
+
+def test_wave_batch_requires_token_and_service() -> None:
+    body = {"user_id": "u", "session_id": "s"}
+    assert client().post("/internal/wave/batch", json=body).status_code == 401
+    r = client().post("/internal/wave/batch", json=body, headers={"Authorization": "Bearer secret"})
+    assert r.status_code == 503