Complete Phase 4: security hardening, player/playlist/admin UI, docs

Security:
- New internal/netguard package: podcast feed/enclosure fetching now
  refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud
  metadata/CGNAT), validated per-connection including across redirects,
  closing an SSRF gap where a malicious or compromised feed URL could
  probe the server's internal network. Configurable via
  VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds.
- Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk)
- Cover art decoding now rejects images above a 40-megapixel budget
  before full decode (decompression-bomb guard)
- HTTP server sets ReadHeaderTimeout (slowloris hardening)
- Admin folder-scan redirect now validated as same-site instead of
  trusting the raw Referer header (open-redirect fix)
- Legacy Subsonic token/salt auth now uses a constant-time comparison

Web UI completion:
- Persistent player: shuffle and repeat (off/all/one) controls, wired
  into queue advance/prev logic and persisted like other player state
- Admin user-permissions form: adminRole toggle (with a guard against
  demoting the last remaining admin) and per-user music-folder access
  checkboxes, backed by existing schema/enforcement that was previously
  unreachable from the UI
- Playlist M3U8 import/export

Docs: added docs/client-compatibility.md (honest tracking template —
no client testing has been performed), docs/deployment.md,
docs/security.md, docs/backup.md; refreshed README and cross-links;
added a footnote in docs/subsonic-compatibility.md distinguishing
spec-standard from VibeSonic-original OpenSubsonic extensions.

Also added Go fuzz tests for the external-auth CIDR/IP parser and the
LRC lyrics parser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv

web/templates/admin_user_permissions.html

@@ -4,6 +4,10 @@
     <h2 class="h6">{{.Data.Username}}</h2>
     <form method="post" action="/admin/users/{{.Data.ID}}/permissions">
       {{template "csrf_field" .CSRFToken}}
+      <div class="form-check">
+        <input class="form-check-input" type="checkbox" name="admin" value="1" id="p_admin" {{if .Data.IsAdmin}}checked{{end}}>
+        <label class="form-check-label" for="p_admin"><strong>Administrator</strong></label>
+      </div>
       <div class="form-check">
         <input class="form-check-input" type="checkbox" name="settings" value="1" id="p_settings" {{if .Data.Permissions.Settings}}checked{{end}}>
         <label class="form-check-label" for="p_settings">Settings</label>
@@ -48,8 +52,21 @@
         <input class="form-check-input" type="checkbox" name="video_conversion" value="1" id="p_video" {{if .Data.Permissions.VideoConversion}}checked{{end}}>
         <label class="form-check-label" for="p_video">Video Conversion</label>
       </div>
-      <button type="submit" class="btn btn-primary btn-sm">Save</button>
-      <a href="/admin/users" class="btn btn-sm btn-outline-secondary">Cancel</a>
+      <hr>
+      <h3 class="h6">Music Folder Access</h3>
+      <p class="small text-body-secondary">Leave all unchecked for unrestricted access to every folder.</p>
+      {{range .Data.Folders}}
+      <div class="form-check">
+        <input class="form-check-input" type="checkbox" name="music_folders" value="{{.ID}}" id="f_{{.ID}}" {{if index $.Data.AllowedFolders .ID}}checked{{end}}>
+        <label class="form-check-label" for="f_{{.ID}}">{{.Name}}</label>
+      </div>
+      {{else}}
+      <p class="small text-body-secondary">No music folders configured.</p>
+      {{end}}
+      <div class="mt-3">
+        <button type="submit" class="btn btn-primary btn-sm">Save</button>
+        <a href="/admin/users" class="btn btn-sm btn-outline-secondary">Cancel</a>
+      </div>
     </form>
   </div>
 </div>