Security hardening and first-run/portability improvements

Security (P0):
- Remove committed session-secret default; auto-generate and persist a
  random secret to the config volume when SESSION_SECRET is unset
  (prevents forgeable session cookies / auth bypass).
- Validate playlist names to a safe charset and render sldl configs via
  literal Python substitution instead of sed (closes a command-injection
  and path-traversal path through playlist names).
- shlex-quote credential values written to shell-sourced env files, and
  strip newlines from values patched into .conf files.
- Render playlist .conf files 0600; warn at startup if the master key is
  co-located with the config volume; document keeping it separate.

Portability:
- Configurable timezone via TZ (default UTC) instead of hardcoded Edmonton.
- Remove personal defaults (navidrome user "andrew", ephemeral.club URLs).
- Ship generic example seeds; move the cross-album dedup keep-list and the
  legacy playlist import to editable config files; drop the personal
  _upgrade.csv.
- Generic VPN reference in docker-compose.snippet.yml.

First-run experience:
- Redirect to /setup instead of 500 when OIDC is unconfigured; surface a
  missing master key inline; entrypoint exits with an actionable message
  when the config folder is not writable.
- Add unauthenticated /health (JSON) and /setup (checklist) diagnostics.

Docs:
- Write docs/ARCHITECTURE.md and docs/MIGRATION.md (previously referenced
  but missing); expand README with ownership, backups, advanced settings,
  and migration guidance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pipeline/configs/artist-canonical.list.example

@@ -1,46 +1,30 @@
-# /opt/sldl/configs/artist-canonical.list
+# artist-canonical.list
 #
 # Canonical artist-name casing. One name per line; '#' starts a comment.
-# Names here are written exactly as Spotify (or the artist) stylizes them.
+# Write each name exactly as you want it stored (usually how Spotify or the
+# artist stylizes it).
 #
-# normalize-artist-casing.py looks up every distinct $albumartist value in the
-# beets library; for any value that matches a name here case-insensitively but
-# differs in casing, it runs `beet modify` to rewrite the tag to the canonical
-# form. beets then moves the album folder to the canonical path.
+# The normalize-artist-casing job looks up every distinct album-artist value in
+# your library. For any value that matches a name here case-insensitively but
+# differs in casing, it rewrites the tag to the form below, and beets then moves
+# the album folder to the canonical path.
 #
-# Purpose: prevents Linux → Windows Syncthing collisions like `Mall Grab/` vs
-# `MALL GRAB/` (same path on Windows, different on Linux).
+# Why this matters: it prevents Linux-to-Windows Syncthing collisions like
+# `Mall Grab/` versus `MALL GRAB/` (the same folder on Windows, two folders on
+# Linux), and keeps one artist from being split across differently-cased folders.
 #
 # To add an artist:
-#   1. Look them up on Spotify, copy their displayed name exactly.
-#   2. Append a new line below.
-#   3. Run /opt/sldl/lib/normalize-artist-casing.py to preview, then --apply.
+#   1. Look them up and copy their displayed name exactly.
+#   2. Add a line below.
+#   3. Preview from Settings then Artist Casing, or run the job from Settings
+#      then Jobs.
 #
-# Characters illegal on Windows (`<>:"\?*|`) can appear here — beets's `replace:`
-# rule substitutes them with `_` when generating the on-disk path, so the tag
-# stays Spotify-correct while the folder stays Windows-safe (e.g. `il:lo` tag
-# maps to `il_lo/` folder).
-
-Bicep
-bôa
-Charli xcx
-Charlotte de Witte
-Crush3d
-deadmau5
-DJ HEARTSTRING
-DjRUM
-Doechii
-Eprom
-FM Forest
-il:lo
-KETTAMA
-Mall Grab
-nanobii
-Pasocom Music Club
-Porter Robinson
-Ross from Friends
-Shades
-Svetec
-UMEK
-yuragi
-YOTTO
+# Characters that are illegal in Windows filenames (< > : " \ ? * |) are allowed
+# here. beets substitutes them with `_` when building the on-disk path, so the
+# tag stays correct while the folder stays Windows-safe.
+#
+# This file ships empty. Add your own names below, for example:
+#
+# Mall Grab
+# Charli xcx
+# deadmau5