Render playlist configs directly in-app; retire regen.sh and playlists.json (R3)

The app owns every input to a playlist's sldl .conf (playlists in its DB,
credentials in its encrypted store), so the old
DB -> playlists.json -> regen.sh subprocess -> regex credential patch-back
chain was three serialization hops for no reason. Collapse it:

- credential_service.render_playlist_confs(db) renders each <playlist>.conf
  from _template.conf in one pass: path placeholders substituted as literal
  text, then the four credential lines set, written 0600. This is now the
  single source of .conf rendering.
- playlist_service loses _write_playlists_json and regenerate_confs; _sync_to_disk
  just calls render_playlist_confs and syncs the scheduler. No subprocess, no
  intermediate JSON file.
- render_scope for spotify/soulseek re-renders confs via the same function
  (spotify still also writes _spotify.env for the python scripts). The dead
  _patch_conf_field / _every_playlist_conf helpers are removed.
- Delete pipeline/configs/regen.sh and drop it from the Dockerfile chmod;
  update _template.conf's comments.

Nothing outside playlist_service consumed regen.sh or playlists.json (verified).
Also closes the last remnants of the S2/S3 injection surface: names are
re-validated and path/credential values are substituted as literals, never
through sed or a shell.

Verified: end-to-end render in a throwaway DB (paths, creds incl. a password
with shell metacharacters, 0600, bad-name rejection) and a live re-render of
all 17 playlist configs with credentials preserved.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pipeline/configs/_template.conf

@@ -4,15 +4,17 @@
 # sldl runs as a subprocess inside the alembic container (same container as
 # beets, on gluetun's network namespace for VPN-routed Soulseek P2P).
 
+# This is a TEMPLATE. The app renders one <playlist>.conf per playlist from it
+# (credential_service.render_playlist_confs), substituting PLAYLIST_NAME,
+# SPOTIFY_URL, SLDL_DROPBOX_ROOT and the credential lines below in one pass.
+# The placeholder values here are overwritten at render time; edit the
+# non-placeholder settings (quality, timeouts, ports) to change every playlist.
+
 # ==== Soulseek credentials ====
-# Substituted by the app's credential_service (not regen.sh) whenever the
-# soulseek secret is saved/updated — every rendered <playlist>.conf gets
-# re-patched at that point, independent of playlist add/remove.
 user = SOULSEEK_USER
 pass = SOULSEEK_PASS
 
 # ==== Spotify API credentials ====
-# Substituted by credential_service the same way, on the spotify secret.
 spotify-id = SPOTIFY_CLIENT_ID
 spotify-secret = SPOTIFY_CLIENT_SECRET
 
@@ -21,8 +23,8 @@ input = SPOTIFY_URL
 input-type = spotify
 
 # ==== Output paths ====
-# SLDL_DROPBOX_ROOT is substituted by regen.sh at render time from
-# $MUSIC_DATA_DIR (sldl's own config format has no env-var expansion).
+# SLDL_DROPBOX_ROOT is substituted at render time from $MUSIC_DATA_DIR
+# (sldl's own config format has no env-var expansion).
 path = SLDL_DROPBOX_ROOT/PLAYLIST_NAME
 playlist-path = SLDL_DROPBOX_ROOT/PLAYLIST_NAME/_sldl.m3u8
 write-playlist = true