Phase 2: exhaustive Subsonic 1.16.1 compatibility matrix, README/config/Docker updates

README.md

@@ -6,15 +6,19 @@ binary, SQLite storage, server-rendered Bootstrap 5 templates, dark mode
 by default, minimal JavaScript, and no external services (no Redis, no
 message broker, no microservices, nothing Kubernetes-specific).
 
-**This is Phase 1 of 4.** It builds the foundation — configuration,
-database schema, authentication, the library scanner, metadata reading,
-direct streaming, cover art, and the web UI shell — that later phases
-build the full Subsonic/OpenSubsonic API on top of. Phase 1 does **not**
-implement the Subsonic protocol itself; see
+**This is Phase 2 of 4.** Phase 1 built the foundation (config, schema,
+auth, scanner, metadata, streaming, cover art, web UI shell). Phase 2
+adds a **complete implementation of the original Subsonic REST API
+through version 1.16.1** under `/rest/*` — every endpoint, backed by
+real data, including transcoding, HLS, a real mpv-backed jukebox, and a
+real podcast subsystem. See
 [`docs/subsonic-compatibility.md`](docs/subsonic-compatibility.md) for
-what's planned.
+the full endpoint-by-endpoint matrix. OpenSubsonic extensions are not
+yet implemented (Phase 3).
 
-## Features (Phase 1)
+## Features
+
+### Phase 1: foundation
 
 - SQLite storage (WAL mode, foreign keys, versioned migrations) with a
   schema already modeling artists, albums, songs, genres, contributors,
@@ -41,6 +45,27 @@ what's planned.
   section (users, music folders, scanner status, system settings)
 - `/healthz` and `/readyz`
 
+### Phase 2: Subsonic REST API
+
+- All 76 endpoints of the original Subsonic API through 1.16.1 —
+  browsing (filesystem and ID3), search, playlists, favorites/ratings/
+  scrobbling, sharing, user management with the full permission model,
+  bookmarks, play queue, chat, and library scan status
+- Real ffmpeg-backed transcoding (mp3/opus/aac) and HLS segmenting for
+  `stream`/`hls`, bounded concurrency, killed on client disconnect
+- A real podcast subsystem: RSS feed refresh, bounded background
+  downloads, restart recovery, downloaded episodes stream like any other
+  song
+- A real jukebox backed by `mpv` over its JSON IPC socket — server-side
+  playback, not a simulation; administratively unavailable (with a clear
+  error) if `mpv` isn't installed
+- Both original Subsonic auth modes (token/salt and password, including
+  `enc:` hex), verified against an AES-256-GCM-encrypted credential kept
+  separate from the Argon2id hash used for native login — see
+  [`docs/subsonic-compatibility.md`](docs/subsonic-compatibility.md#authentication)
+- `/rest/*` authentication is entirely independent of the browser
+  session/CSRF/external-auth flow
+
 ## Quick start
 
 ```
@@ -53,8 +78,11 @@ the setup wizard, which creates the administrator account, your first
 music folder, and kicks off the first scan.
 
 `ffmpeg`/`ffprobe` should be on `PATH` (or pointed to via
-`VIBESONIC_FFMPEG_PATH`/`VIBESONIC_FFPROBE_PATH`) for metadata reading
-and cover art extraction to work.
+`VIBESONIC_FFMPEG_PATH`/`VIBESONIC_FFPROBE_PATH`) for metadata reading,
+cover art extraction, and transcoding/HLS to work. `mpv` should be on
+`PATH` (or pointed to via `VIBESONIC_MPV_PATH`) for the jukebox to be
+available — without it, `jukeboxControl` returns a clear "unavailable"
+error rather than pretending to work.
 
 ### Docker