Complete Phase 4: security hardening, player/playlist/admin UI, docs

Security:
- New internal/netguard package: podcast feed/enclosure fetching now
  refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud
  metadata/CGNAT), validated per-connection including across redirects,
  closing an SSRF gap where a malicious or compromised feed URL could
  probe the server's internal network. Configurable via
  VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds.
- Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk)
- Cover art decoding now rejects images above a 40-megapixel budget
  before full decode (decompression-bomb guard)
- HTTP server sets ReadHeaderTimeout (slowloris hardening)
- Admin folder-scan redirect now validated as same-site instead of
  trusting the raw Referer header (open-redirect fix)
- Legacy Subsonic token/salt auth now uses a constant-time comparison

Web UI completion:
- Persistent player: shuffle and repeat (off/all/one) controls, wired
  into queue advance/prev logic and persisted like other player state
- Admin user-permissions form: adminRole toggle (with a guard against
  demoting the last remaining admin) and per-user music-folder access
  checkboxes, backed by existing schema/enforcement that was previously
  unreachable from the UI
- Playlist M3U8 import/export

Docs: added docs/client-compatibility.md (honest tracking template —
no client testing has been performed), docs/deployment.md,
docs/security.md, docs/backup.md; refreshed README and cross-links;
added a footnote in docs/subsonic-compatibility.md distinguishing
spec-standard from VibeSonic-original OpenSubsonic extensions.

Also added Go fuzz tests for the external-auth CIDR/IP parser and the
LRC lyrics parser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv

internal/podcasts/podcasts.go

@@ -23,9 +23,16 @@ import (
 	"git.noroutes.net/NoRoutes/vibetunes/internal/database"
 	"git.noroutes.net/NoRoutes/vibetunes/internal/idgen"
 	"git.noroutes.net/NoRoutes/vibetunes/internal/metadata"
+	"git.noroutes.net/NoRoutes/vibetunes/internal/netguard"
 )
 
-const maxConcurrentDownloads = 2
+const (
+	maxConcurrentDownloads = 2
+	// maxEnclosureSize bounds a single episode download so a malicious
+	// or misbehaving feed can't exhaust disk space; legitimate podcast
+	// episodes are essentially never larger than this.
+	maxEnclosureSize = 4 << 30 // 4GB
+)
 
 type Manager struct {
 	DB          *sql.DB
@@ -37,12 +44,18 @@ type Manager struct {
 	sem chan struct{}
 }
 
-func NewManager(db *sql.DB, dataDir, ffprobePath string, log *slog.Logger) *Manager {
+// NewManager builds a podcast manager whose HTTP client refuses to
+// connect to non-public (loopback/LAN/link-local/cloud-metadata)
+// addresses — feed URLs and episode enclosure URLs are attacker- or
+// admin-supplied and must never turn VibeSonic into an internal
+// network proxy. Set allowPrivateNetworks only for deployments that
+// intentionally host feeds on a private network.
+func NewManager(db *sql.DB, dataDir, ffprobePath string, log *slog.Logger, allowPrivateNetworks bool) *Manager {
 	return &Manager{
 		DB:          db,
 		DataDir:     dataDir,
 		FFprobePath: ffprobePath,
-		HTTPClient:  &http.Client{Timeout: 60 * time.Second},
+		HTTPClient:  netguard.NewSafeHTTPClient(60*time.Second, allowPrivateNetworks),
 		Log:         log,
 		sem:         make(chan struct{}, maxConcurrentDownloads),
 	}
@@ -78,6 +91,11 @@ func (m *Manager) RefreshChannel(ctx context.Context, channelID string) error {
 	}
 	_ = database.SetPodcastChannelStatus(m.DB, channelID, "downloading", "")
 
+	if err := netguard.ValidateURL(channel.URL); err != nil {
+		_ = database.SetPodcastChannelStatus(m.DB, channelID, "error", err.Error())
+		return err
+	}
+
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, channel.URL, nil)
 	if err != nil {
 		_ = database.SetPodcastChannelStatus(m.DB, channelID, "error", err.Error())
@@ -235,6 +253,9 @@ func (m *Manager) DownloadEpisode(ctx context.Context, episodeID string) error {
 }
 
 func (m *Manager) downloadToFile(ctx context.Context, sourceURL, destPath string) error {
+	if err := netguard.ValidateURL(sourceURL); err != nil {
+		return err
+	}
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, sourceURL, nil)
 	if err != nil {
 		return err
@@ -253,11 +274,17 @@ func (m *Manager) downloadToFile(ctx context.Context, sourceURL, destPath string
 	if err != nil {
 		return err
 	}
-	if _, err := io.Copy(out, resp.Body); err != nil {
+	n, err := io.Copy(out, io.LimitReader(resp.Body, maxEnclosureSize+1))
+	if err != nil {
 		out.Close()
 		os.Remove(tmp)
 		return err
 	}
+	if n > maxEnclosureSize {
+		out.Close()
+		os.Remove(tmp)
+		return fmt.Errorf("enclosure exceeds maximum allowed size of %d bytes", maxEnclosureSize)
+	}
 	if err := out.Close(); err != nil {
 		os.Remove(tmp)
 		return err