P2 minor set: password off argv, configurable share gate, POST logout, log path check

- Navidrome password is now passed to curl via stdin (--data-urlencode "p@-")
  in navidrome-scan.sh and pipeline-status.sh, so it no longer appears in
  ps/proc. Verified the query sent is identical and a live scan still triggers.
- MIN_ARTIST_DIRS (the share-health gate) is now a setting, threaded through to
  the pipeline env, so a user with a small library can lower it instead of the
  scan/sync being permanently blocked by the hardcoded 500.
- /auth/logout is now POST-only (with a nav form + aria-label), so a drive-by
  GET can't log the user out; enforced allowed_email already landed separately.
- view_log now confirms the run's log_path resolves under the logs dir before
  serving it (defense in depth).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pipeline/lib/navidrome-scan.sh

@@ -21,7 +21,7 @@ NAVIDROME_ENV="$ALEMBIC_CONFIG_DIR/pipeline/navidrome/admin.env"
 
 LIB="$MUSIC_DATA_DIR/Library"
 CANARY="$LIB/.navidrome-canary"
-MIN_ARTIST_DIRS=500          # library has ~1500; 500 is "clearly not wiped"
+MIN_ARTIST_DIRS="${MIN_ARTIST_DIRS:-500}"   # override via env for a small library
 ND="${ND_BASE:-http://navidrome:4533}"
 ND_USER="${ND_USER:-}"
 ND_PASS="${ND_PASS:-}"
@@ -46,8 +46,10 @@ if [ "$n" -lt "$MIN_ARTIST_DIRS" ]; then
 fi
 
 log "library healthy ($n artist dirs) — triggering full scan"
-resp=$(curl -s -G "$ND/rest/startScan.view" \
-    --data-urlencode "u=$ND_USER" --data-urlencode "p=$ND_PASS" \
+# Pass the password via stdin (--data-urlencode "p@-"), not on the command
+# line, so it isn't visible in ps/proc. printf %s avoids a trailing newline.
+resp=$(printf '%s' "$ND_PASS" | curl -s -G "$ND/rest/startScan.view" \
+    --data-urlencode "u=$ND_USER" --data-urlencode "p@-" \
     --data-urlencode 'v=1.16.0' --data-urlencode 'c=cron' \
     --data-urlencode 'f=json' --data-urlencode 'fullScan=true' || true)
 # Don't log "scan triggered" on faith: a rotated password or Navidrome error