Complete Phase 4: security hardening, player/playlist/admin UI, docs

Security:
- New internal/netguard package: podcast feed/enclosure fetching now
  refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud
  metadata/CGNAT), validated per-connection including across redirects,
  closing an SSRF gap where a malicious or compromised feed URL could
  probe the server's internal network. Configurable via
  VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds.
- Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk)
- Cover art decoding now rejects images above a 40-megapixel budget
  before full decode (decompression-bomb guard)
- HTTP server sets ReadHeaderTimeout (slowloris hardening)
- Admin folder-scan redirect now validated as same-site instead of
  trusting the raw Referer header (open-redirect fix)
- Legacy Subsonic token/salt auth now uses a constant-time comparison

Web UI completion:
- Persistent player: shuffle and repeat (off/all/one) controls, wired
  into queue advance/prev logic and persisted like other player state
- Admin user-permissions form: adminRole toggle (with a guard against
  demoting the last remaining admin) and per-user music-folder access
  checkboxes, backed by existing schema/enforcement that was previously
  unreachable from the UI
- Playlist M3U8 import/export

Docs: added docs/client-compatibility.md (honest tracking template —
no client testing has been performed), docs/deployment.md,
docs/security.md, docs/backup.md; refreshed README and cross-links;
added a footnote in docs/subsonic-compatibility.md distinguishing
spec-standard from VibeSonic-original OpenSubsonic extensions.

Also added Go fuzz tests for the external-auth CIDR/IP parser and the
LRC lyrics parser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv

docs/client-compatibility.md

@@ -0,0 +1,69 @@
+# Client compatibility
+
+This is a **tracking template**, not a report of testing that has
+already happened. As of this phase, no real Subsonic/OpenSubsonic
+client apps have been run against VibeSonic in this development
+environment — every row below is unfilled and marked accordingly. Please
+do not read the table as evidence of compatibility; read
+[`docs/subsonic-compatibility.md`](subsonic-compatibility.md) for that —
+it documents endpoint-by-endpoint protocol conformance validated by
+VibeSonic's own automated HTTP-level test suite (`internal/subsonic/*_test.go`),
+which is real evidence, exercised on every change. This document exists
+to capture *real device/app* testing once someone actually does it.
+
+## How to test a client and fill in a row
+
+1. Point the client at your VibeSonic server URL, e.g.
+   `https://music.example.com` or `http://<host>:8080` for a direct,
+   un-proxied connection. Most Subsonic clients want the base URL only
+   (no `/rest` suffix) plus a username/password — they construct
+   `/rest/*` requests themselves.
+2. **Authentication**: try native username/password first (works whether
+   or not external auth is enabled, as long as the account has a local
+   password — see [`external-auth.md`](external-auth.md)). If the client
+   supports OpenSubsonic API keys (the `apiKeyAuthentication` extension —
+   see [`subsonic-compatibility.md`](subsonic-compatibility.md#opensubsonic-extensions)),
+   generate one from the web UI's account settings and test that path
+   too, noting which the client actually used.
+3. Work through: server discovery/ping, browsing (artists/albums/songs,
+   both filesystem and ID3 modes if the client exposes both), search,
+   cover art, direct streaming, forced transcoding (pick a bitrate/format
+   the source file doesn't already match), playlists (create/edit/
+   delete/reorder), favorites/star, scrobbling, lyrics (plain and
+   synced, if the client supports OpenSubsonic's `songLyrics`), the play
+   queue, downloads, podcasts (if the client has podcast support), and
+   any OpenSubsonic-specific features the client advertises.
+4. Fill in the row below with what actually worked, partially worked, or
+   didn't — and describe **Known Issues** concretely (not "broken", but
+   "album art doesn't load for tracks with only embedded art, HTTP 404"
+   or similar) so someone else can reproduce or fix it.
+5. If a client needs a compatibility workaround (bending strict protocol
+   behavior to accommodate something the client gets wrong), that
+   exception must be documented here **and** in
+   [`subsonic-compatibility.md`](subsonic-compatibility.md) next to the
+   affected endpoint — don't silently special-case a client in code
+   without a paper trail.
+
+## Tracking table
+
+| Client | Version | Platform | Authentication | Browsing | Streaming | Transcoding | Playlists | Lyrics | OpenSubsonic | Known Issues |
+|---|---|---|---|---|---|---|---|---|---|---|
+| Symfonium | — | Android | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
+| Ultrasonic | — | Android | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
+| Tempo | — | iOS | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
+| Amperfy | — | iOS/macOS | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
+| play:Sub | — | iOS | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
+| Subtracks | — | Android | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
+| DSub | — | Android | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
+| Supersonic | — | Desktop (Linux/macOS/Windows) | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
+| Feishin | — | Desktop/Web | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
+
+Add new rows for any other client you test — this list isn't exhaustive,
+just a reasonable starting set across ecosystems (Android, iOS, desktop).
+
+## Compatibility exceptions
+
+None recorded yet. If a real client requires bending protocol behavior
+to work correctly, document the exception here: which client/version,
+what VibeSonic does differently and why, and a link to the affected
+endpoint in [`subsonic-compatibility.md`](subsonic-compatibility.md).