feat(subsonic): browsing, search, media, playlist, annotation endpoints

Thin adapters over the existing services/repositories (no business logic):

- system: ping (auth check), getLicense
- browsing: getArtists/getArtist/getAlbum, getAlbumList(2) (newest/alpha/random),
  getSong, getGenres, getMusicFolders/getIndexes/getMusicDirectory (one folder)
- search: search3 (delegates to the library repos)
- media: stream + download (reuse StreamingService, honor Range); getCoverArt
  returns a placeholder until the cover pipeline lands
- playlists: get/create/update/delete over the playlist repo (owner-scoped)
- annotation: star/unstar → append-only like log, scrobble → play history,
  setRating → clean no-op
- all endpoints also accept the .view suffix and GET+POST for client compat

Repo support: album list ordering (newest/random), track genre facets.
README documents the mandatory-HTTPS requirement and app-password workflow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/rest/system.py

@@ -1,15 +1,22 @@
 """Subsonic system endpoints: ping and license."""
 
-from typing import Any
+from fastapi import APIRouter, Response
 
-from fastapi import APIRouter
+from app.api.deps import SubsonicFormat, SubsonicUser
+from app.api.rest.envelope import subsonic_response
 
 router = APIRouter()
 
 
-@router.get("/ping")
-async def ping() -> Any: ...
+@router.api_route("/ping", methods=["GET", "POST"])
+@router.api_route("/ping.view", methods=["GET", "POST"])
+async def ping(_user: SubsonicUser, fmt: SubsonicFormat) -> Response:
+    # Requiring auth makes ping a credential check — exactly how clients use it.
+    return subsonic_response(fmt=fmt)
 
 
-@router.get("/getLicense")
-async def get_license() -> Any: ...
+@router.api_route("/getLicense", methods=["GET", "POST"])
+@router.api_route("/getLicense.view", methods=["GET", "POST"])
+async def get_license(_user: SubsonicUser, fmt: SubsonicFormat) -> Response:
+    # Self-hosted and free — the license is always valid.
+    return subsonic_response({"license": {"valid": True}}, fmt=fmt)