Complete Phase 4: security hardening, player/playlist/admin UI, docs

Security:
- New internal/netguard package: podcast feed/enclosure fetching now
  refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud
  metadata/CGNAT), validated per-connection including across redirects,
  closing an SSRF gap where a malicious or compromised feed URL could
  probe the server's internal network. Configurable via
  VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds.
- Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk)
- Cover art decoding now rejects images above a 40-megapixel budget
  before full decode (decompression-bomb guard)
- HTTP server sets ReadHeaderTimeout (slowloris hardening)
- Admin folder-scan redirect now validated as same-site instead of
  trusting the raw Referer header (open-redirect fix)
- Legacy Subsonic token/salt auth now uses a constant-time comparison

Web UI completion:
- Persistent player: shuffle and repeat (off/all/one) controls, wired
  into queue advance/prev logic and persisted like other player state
- Admin user-permissions form: adminRole toggle (with a guard against
  demoting the last remaining admin) and per-user music-folder access
  checkboxes, backed by existing schema/enforcement that was previously
  unreachable from the UI
- Playlist M3U8 import/export

Docs: added docs/client-compatibility.md (honest tracking template —
no client testing has been performed), docs/deployment.md,
docs/security.md, docs/backup.md; refreshed README and cross-links;
added a footnote in docs/subsonic-compatibility.md distinguishing
spec-standard from VibeSonic-original OpenSubsonic extensions.

Also added Go fuzz tests for the external-auth CIDR/IP parser and the
LRC lyrics parser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv

internal/config/cidr_fuzz_test.go

@@ -0,0 +1,28 @@
+package config
+
+import "testing"
+
+// FuzzParseCIDROrIP guards against a crash in the
+// VIBESONIC_EXTAUTH_TRUSTED_SOURCES parser, which is security-sensitive:
+// it decides which peers are trusted to assert an authenticated
+// identity via external auth.
+func FuzzParseCIDROrIP(f *testing.F) {
+	f.Add("127.0.0.1/32")
+	f.Add("10.0.0.0/8")
+	f.Add("::1")
+	f.Add("fd00::/8")
+	f.Add("")
+	f.Add("not-an-ip")
+	f.Add("127.0.0.1/99")
+	f.Add("999.999.999.999")
+	f.Add("::/0")
+
+	f.Fuzz(func(t *testing.T, s string) {
+		defer func() {
+			if r := recover(); r != nil {
+				t.Fatalf("parseCIDROrIP panicked on %q: %v", s, r)
+			}
+		}()
+		_, _ = parseCIDROrIP(s)
+	})
+}

internal/config/config.go

@@ -33,6 +33,15 @@ type Config struct {
 	// to the outside world.
 	EnableExternalMetadata bool
 
+	// PodcastsAllowPrivateNetworks disables SSRF protection on podcast
+	// feed/enclosure fetching, allowing feeds hosted on loopback/LAN/
+	// link-local addresses. Off by default: podcast URLs are supplied
+	// by an admin (or, in principle, a compromised feed's redirects)
+	// and must not be usable to probe the server's own internal
+	// network. Only enable this for deployments that intentionally
+	// host podcast feeds on a private network.
+	PodcastsAllowPrivateNetworks bool
+
 	ExtAuth ExtAuthConfig
 }
 
@@ -62,6 +71,8 @@ func Load() (Config, error) {
 		CookieSecure:  envBool("VIBESONIC_COOKIE_SECURE", true),
 
 		EnableExternalMetadata: envBool("VIBESONIC_ENABLE_EXTERNAL_METADATA", false),
+
+		PodcastsAllowPrivateNetworks: envBool("VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS", false),
 	}
 	cfg.DBPath = envOr("VIBESONIC_DB", filepath.Join(cfg.DataDir, "vibesonic.db"))