P2 minor set: password off argv, configurable share gate, POST logout, log path check

- Navidrome password is now passed to curl via stdin (--data-urlencode "p@-")
  in navidrome-scan.sh and pipeline-status.sh, so it no longer appears in
  ps/proc. Verified the query sent is identical and a live scan still triggers.
- MIN_ARTIST_DIRS (the share-health gate) is now a setting, threaded through to
  the pipeline env, so a user with a small library can lower it instead of the
  scan/sync being permanently blocked by the hardcoded 500.
- /auth/logout is now POST-only (with a nav form + aria-label), so a drive-by
  GET can't log the user out; enforced allowed_email already landed separately.
- view_log now confirms the run's log_path resolves under the logs dir before
  serving it (defense in depth).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/templates/base.html

@@ -51,7 +51,9 @@
       <div class="user-chip">
         <span class="user-dot"></span>
         <span>{{ user.email or user.name }}</span>
-        <a class="logout" href="/auth/logout" title="Log out">&#9211;</a>
+        <form method="post" action="/auth/logout" style="display:inline; margin:0;">
+          <button type="submit" class="logout" title="Log out" aria-label="Log out">&#9211;</button>
+        </form>
       </div>
       {% endif %}
     </div>