Credential enable/disable + descriptions, artist casing settings page, playlist compare view

Credentials page now shows a fact-checked one-line description per
service and marks Spotify/Soulseek/Navidrome as Required (no toggle --
they're load-bearing for every playlist sync). The four optional
integrations (Bandcamp, AzuraCast, Qobuz, Telegram) get a real on/off
switch: Bandcamp pauses its scheduled job (same mechanism as the Jobs
page), the other three just remove their rendered credential file, which
the scripts that read them already treat as "not configured, skip" --
no script changes needed. Disabled optional scopes also drop off the
dashboard's credential status row.

New Settings > Artist Casing page to view/add/remove entries in
artist-canonical.list without shelling in -- adding a name that already
matches case-insensitively replaces its casing in place instead of
duplicating.

Playlist detail page's status section is now two side-by-side columns:
the original Spotify tracklist on the left, and a tabbed Downloaded /
Waiting-to-download view on the right (client-side tabs via Alpine),
both with an internal scroll area so long playlists don't pull the
columns out of sync. Uses the existing status_service reconciliation
(sldl index + beets + quarantine) -- no backend changes needed there.

app/services/artist_canonical_service.py

@@ -0,0 +1,55 @@
+from pathlib import Path
+
+from app.settings import settings
+
+# Instance state, not baked into the image -- seeded from
+# pipeline/configs/artist-canonical.list.example on first boot (see
+# entrypoint.sh) and edited from here after that. Read directly by
+# normalize-artist-casing.py at run time, same file, no caching.
+
+
+def _path() -> Path:
+    return settings.pipeline_config_dir / "artist-canonical.list"
+
+
+def _is_entry_line(line: str) -> bool:
+    stripped = line.strip()
+    return bool(stripped) and not stripped.startswith("#")
+
+
+def list_entries() -> list[str]:
+    path = _path()
+    if not path.exists():
+        return []
+    return [line.strip() for line in path.read_text(encoding="utf-8").splitlines() if _is_entry_line(line)]
+
+
+def add_entry(name: str) -> None:
+    """Append a canonical name, or if one already matches case-insensitively
+    (the whole point of this list is one canonical casing per artist),
+    replace that line's casing instead of adding a duplicate."""
+    name = name.strip()
+    if not name:
+        raise ValueError("artist name cannot be empty")
+
+    path = _path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    lines = path.read_text(encoding="utf-8").splitlines() if path.exists() else []
+
+    for i, line in enumerate(lines):
+        if _is_entry_line(line) and line.strip().lower() == name.lower():
+            lines[i] = name
+            path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+            return
+
+    lines.append(name)
+    path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+
+
+def remove_entry(name: str) -> None:
+    path = _path()
+    if not path.exists():
+        return
+    lines = path.read_text(encoding="utf-8").splitlines()
+    lines = [line for line in lines if not (_is_entry_line(line) and line.strip() == name)]
+    path.write_text("\n".join(lines) + "\n", encoding="utf-8")

app/services/credential_service.py

@@ -5,7 +5,7 @@ from pathlib import Path
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
-from app.models import Secret
+from app.models import AppSetting, Secret
 from app.security import crypto
 from app.settings import settings
 
@@ -21,6 +21,28 @@ SCOPE_FIELDS = {
     "telegram": ["bot_token", "chat_id"],
 }
 
+# One line explaining what each service is actually used for, shown on the
+# credentials page so "should I bother setting this up" is answerable
+# without reading the pipeline scripts.
+SCOPE_DESCRIPTIONS = {
+    "spotify": "Reads playlist tracks and metadata (artist, title, album, genre) for every synced playlist, tag rewriting, and the genre refill job. Required.",
+    "soulseek": "Logs into Soulseek so sldl can search for and download tracks. Required.",
+    "navidrome": "Triggers a library rescan after downloads/imports/edits, and lets the daily status report check Navidrome's scan health. Required.",
+    "bandcamp": "Pulls new purchases from your Bandcamp collection, imports them automatically, and stamps a buy link into the file tag.",
+    "qobuz": "A buy-link source (alongside Bandcamp) for tracks you didn't purchase there -- DRM-free hi-res links when available, written directly into the file tag.",
+    "azuracast": "Not a buy-link source itself (that's Bandcamp/Qobuz, written straight to the file tag) -- this lets alembic tell AzuraCast (ephemeral.club's backend) to immediately reprocess touched files or fix a playlist assignment, instead of waiting for its periodic scan.",
+    "telegram": "Sends the daily pipeline health digest to a chat instead of you having to check the dashboard.",
+}
+
+# spotify/soulseek/navidrome are load-bearing for every playlist sync --
+# there's no clean single place to "pause" them without silently breaking
+# the whole pipeline, so they're always on and not shown with a toggle.
+# The rest are optional add-ons that render to their own standalone
+# credential file(s), which the scripts that read them already treat a
+# missing/empty file as "not configured, skip this" -- see _clear_rendered().
+CORE_SCOPES = {"spotify", "soulseek", "navidrome"}
+OPTIONAL_SCOPES = {"bandcamp", "azuracast", "qobuz", "telegram"}
+
 
 def _upsert(db: Session, scope: str, key: str, value: str) -> None:
     row = db.execute(
@@ -184,6 +206,71 @@ def render_scope(db: Session, scope: str) -> None:
         raise ValueError(f"unknown credential scope: {scope}")
 
 
+def _enabled_key(scope: str) -> str:
+    return f"cred_enabled:{scope}"
+
+
+def is_scope_enabled(db: Session, scope: str) -> bool:
+    """Core scopes are always enabled. Optional scopes default to enabled
+    (matches pre-existing behavior for anyone who already had them
+    configured before this toggle existed) until explicitly turned off."""
+    if scope in CORE_SCOPES:
+        return True
+    row = db.execute(select(AppSetting).where(AppSetting.key == _enabled_key(scope))).scalar_one_or_none()
+    return row is None or row.value == "1"
+
+
+def _clear_rendered(scope: str) -> None:
+    """Remove the standalone rendered credential file(s) for a disabled
+    optional scope, without touching the encrypted Secret rows -- the
+    script that reads each of these already treats a missing file as
+    "not configured, skip this source" (see enrich-buy-url.py's docstring
+    for qobuz/azuracast, and pipeline-status.sh's handling of a failed
+    notify-telegram.sh call). Re-enabling calls render_scope() again to
+    recreate the file from the still-stored values."""
+    if scope == "azuracast":
+        (settings.pipeline_config_dir / "azuracast" / "api_key").unlink(missing_ok=True)
+    elif scope == "qobuz":
+        qobuz_dir = settings.pipeline_config_dir / "qobuz"
+        for name in ("token", "app_id", "region"):
+            (qobuz_dir / name).unlink(missing_ok=True)
+    elif scope == "telegram":
+        (settings.pipeline_config_dir / "telegram" / "notify.env").unlink(missing_ok=True)
+
+
+def set_scope_enabled(db: Session, scope: str, enabled: bool) -> None:
+    """Toggle an optional integration on/off without discarding its saved
+    credentials. Bandcamp is the one optional scope with its own dedicated
+    scheduled job (maintenance:sync_bandcamp) -- that job hard-fails if its
+    cookies file goes missing (see sync-bandcamp.sh), so bandcamp is gated
+    by pausing the job itself (the same enable/disable machinery the Jobs
+    page already uses) rather than by removing its rendered files. The
+    other three scopes have no job of their own; the script that reads
+    them already skips gracefully on a missing file, so removing the
+    rendered file is enough."""
+    if scope not in OPTIONAL_SCOPES:
+        raise ValueError(f"{scope} cannot be toggled")
+
+    key = _enabled_key(scope)
+    row = db.execute(select(AppSetting).where(AppSetting.key == key)).scalar_one_or_none()
+    if row is None:
+        db.add(AppSetting(key=key, value="1" if enabled else "0"))
+    else:
+        row.value = "1" if enabled else "0"
+    db.commit()
+
+    if scope == "bandcamp":
+        from app.services import scheduler_service
+
+        scheduler = scheduler_service.get_scheduler()
+        if scheduler is not None:
+            scheduler_service.set_maintenance_enabled(scheduler, "maintenance:sync_bandcamp", enabled)
+    elif enabled:
+        render_scope(db, scope)
+    else:
+        _clear_rendered(scope)
+
+
 def _bandcamp_cookie_expiry(cookies_txt: str) -> float | None:
     """Parse the Netscape-format cookie jar for the 'identity' cookie's
     expiry (Unix timestamp) -- same field pipeline-status.sh already reads
@@ -208,6 +295,8 @@ def auth_states(db: Session) -> list[dict]:
     page load)."""
     states = []
     for scope in SCOPE_FIELDS:
+        if scope in OPTIONAL_SCOPES and not is_scope_enabled(db, scope):
+            continue  # turned off -- don't clutter the dashboard with it
         values = get_scope(db, scope)
         configured = bool(values)
         entry = {"scope": scope, "configured": configured}