P2 minor set: password off argv, configurable share gate, POST logout, log path check

- Navidrome password is now passed to curl via stdin (--data-urlencode "p@-")
  in navidrome-scan.sh and pipeline-status.sh, so it no longer appears in
  ps/proc. Verified the query sent is identical and a live scan still triggers.
- MIN_ARTIST_DIRS (the share-health gate) is now a setting, threaded through to
  the pipeline env, so a user with a small library can lower it instead of the
  scan/sync being permanently blocked by the hardcoded 500.
- /auth/logout is now POST-only (with a nav form + aria-label), so a drive-by
  GET can't log the user out; enforced allowed_email already landed separately.
- view_log now confirms the run's log_path resolves under the logs dir before
  serving it (defense in depth).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/static/style.css

@@ -219,11 +219,21 @@ a:hover { color: var(--iris-pink); text-decoration: underline; }
   background: var(--status-success);
   box-shadow: 0 0 8px var(--status-success);
 }
-.user-chip a.logout {
+.user-chip a.logout,
+.user-chip button.logout {
   color: var(--muted-2);
   font-size: 0.95rem;
 }
-.user-chip a.logout:hover { color: var(--status-danger); text-decoration: none; }
+.user-chip button.logout {
+  background: none;
+  border: none;
+  padding: 0;
+  cursor: pointer;
+  font-family: inherit;
+  line-height: 1;
+}
+.user-chip a.logout:hover,
+.user-chip button.logout:hover { color: var(--status-danger); text-decoration: none; }
 
 /* ---- layout ---- */