Security hardening and first-run/portability improvements

Security (P0):
- Remove committed session-secret default; auto-generate and persist a
  random secret to the config volume when SESSION_SECRET is unset
  (prevents forgeable session cookies / auth bypass).
- Validate playlist names to a safe charset and render sldl configs via
  literal Python substitution instead of sed (closes a command-injection
  and path-traversal path through playlist names).
- shlex-quote credential values written to shell-sourced env files, and
  strip newlines from values patched into .conf files.
- Render playlist .conf files 0600; warn at startup if the master key is
  co-located with the config volume; document keeping it separate.

Portability:
- Configurable timezone via TZ (default UTC) instead of hardcoded Edmonton.
- Remove personal defaults (navidrome user "andrew", ephemeral.club URLs).
- Ship generic example seeds; move the cross-album dedup keep-list and the
  legacy playlist import to editable config files; drop the personal
  _upgrade.csv.
- Generic VPN reference in docker-compose.snippet.yml.

First-run experience:
- Redirect to /setup instead of 500 when OIDC is unconfigured; surface a
  missing master key inline; entrypoint exits with an actionable message
  when the config folder is not writable.
- Add unauthenticated /health (JSON) and /setup (checklist) diagnostics.

Docs:
- Write docs/ARCHITECTURE.md and docs/MIGRATION.md (previously referenced
  but missing); expand README with ownership, backups, advanced settings,
  and migration guidance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pipeline/configs/djmix-albums.txt.example

@@ -4,32 +4,17 @@
 # are passed as a single beet query argument. Lines containing | are split on |
 # and each part is passed as a separate beet query term (ANDed together).
 #
-# Use | to combine albumartist and album constraints, e.g.:
-#   albumartist::Porter Robinson | album:Secret Sky 2021
+# Use | to combine an album-artist and an album constraint, for example:
+#   albumartist::Some Artist | album:Some Live Set 2024
 #
-# Single-field lines with spaces work fine as one arg — beet treats the whole
-# string after the colon as the value. Do NOT word-split commas-in-names.
+# Single-field lines with spaces work fine as one argument, because beet treats
+# the whole string after the colon as the value. Do not split names on commas.
 #
-# To add an album, find the exact name first:
-#   docker exec soulbeet beet ls -f '$albumartist|$album' 'artist:Name' | sort -u
-# Then add a line and run: sudo /opt/sldl/lib/gen-djmix-playlist.sh
-
-# ---- Fred again.. — Live DJ sets ----
-album:Apple Music Live: Fred again..
-album:Live from Lyon, France, Oct 24, 2025
-album:Alexandra Palace, London, Feb 27, 2026
-album:Live from Toronto, Canada, Nov 14, 2025
-
-# ---- Porter Robinson — Live performances / DJ sets ----
-albumartist::Porter Robinson | album:Secret Sky 2021
-albumartist::Porter Robinson | album:Worlds Live at Second Sky 2019
-albumartist::Porter Robinson | album:Shelter Live
-
-# ---- Virtual Self b2b G Jones ----
-albumartist::Virtual Self | album:Second Sky 2022
-
-# ---- Air2Earth ----
-albumartist::^Air2Earth$ | album:Splash House
-
-# ---- G Jones — add more DJ mix albums below ----
-# Find album names with: docker exec soulbeet beet ls -f '$albumartist|$album' 'artist:"G Jones"' | sort -u
+# To find the exact album name in your own library first:
+#   beet ls -f '$albumartist|$album' 'artist:Name' | sort -u
+# Then add a line and run the DJ-mix playlist job.
+#
+# This file ships empty. Add your own albums below, for example:
+#
+# album:Some Live Set 2024
+# albumartist::Some Artist | album:Secret Show 2023