Complete Phase 4: security hardening, player/playlist/admin UI, docs

Security:
- New internal/netguard package: podcast feed/enclosure fetching now
  refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud
  metadata/CGNAT), validated per-connection including across redirects,
  closing an SSRF gap where a malicious or compromised feed URL could
  probe the server's internal network. Configurable via
  VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds.
- Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk)
- Cover art decoding now rejects images above a 40-megapixel budget
  before full decode (decompression-bomb guard)
- HTTP server sets ReadHeaderTimeout (slowloris hardening)
- Admin folder-scan redirect now validated as same-site instead of
  trusting the raw Referer header (open-redirect fix)
- Legacy Subsonic token/salt auth now uses a constant-time comparison

Web UI completion:
- Persistent player: shuffle and repeat (off/all/one) controls, wired
  into queue advance/prev logic and persisted like other player state
- Admin user-permissions form: adminRole toggle (with a guard against
  demoting the last remaining admin) and per-user music-folder access
  checkboxes, backed by existing schema/enforcement that was previously
  unreachable from the UI
- Playlist M3U8 import/export

Docs: added docs/client-compatibility.md (honest tracking template —
no client testing has been performed), docs/deployment.md,
docs/security.md, docs/backup.md; refreshed README and cross-links;
added a footnote in docs/subsonic-compatibility.md distinguishing
spec-standard from VibeSonic-original OpenSubsonic extensions.

Also added Go fuzz tests for the external-auth CIDR/IP parser and the
LRC lyrics parser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv

internal/subsonic/auth.go

@@ -2,6 +2,7 @@ package subsonic
 
 import (
 	"crypto/md5"
+	"crypto/subtle"
 	"database/sql"
 	"encoding/hex"
 	"strconv"
@@ -60,7 +61,7 @@ func authenticate(db *sql.DB, encryptionKey []byte, p params) (*database.User, *
 		}
 		sum := md5.Sum([]byte(plaintext + salt))
 		expected := hex.EncodeToString(sum[:])
-		if !strings.EqualFold(expected, token) {
+		if subtle.ConstantTimeCompare([]byte(expected), []byte(strings.ToLower(token))) != 1 {
 			return nil, errWrongCredentials
 		}
 

internal/subsonic/podcasts.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 
 	"git.noroutes.net/NoRoutes/vibetunes/internal/database"
+	"git.noroutes.net/NoRoutes/vibetunes/internal/netguard"
 )
 
 func init() {
@@ -176,6 +177,9 @@ func handleCreatePodcastChannel(rc *Context) *apiError {
 	if aerr != nil {
 		return aerr
 	}
+	if err := netguard.ValidateURL(feedURL); err != nil {
+		return newError(ErrGeneric, err.Error())
+	}
 	channel, err := database.CreatePodcastChannel(rc.Server.DB, feedURL)
 	if err != nil {
 		return newError(ErrGeneric, err.Error())

internal/subsonic/testutil_test.go

@@ -40,7 +40,7 @@ func newTestServer(t *testing.T) (*Server, *sql.DB) {
 		Scanner:       scanner.New(db, &metadata.Prober{}, log),
 		CoverArt:      coverart.New(t.TempDir(), ""),
 		Transcoder:    transcoding.NewManager(""),
-		Podcasts:      podcasts.NewManager(db, t.TempDir(), "", log),
+		Podcasts:      podcasts.NewManager(db, t.TempDir(), "", log, true),
 		Jukebox:       jukebox.New(""),
 		Log:           log,
 	}