Security hardening and first-run/portability improvements

Security (P0):
- Remove committed session-secret default; auto-generate and persist a
  random secret to the config volume when SESSION_SECRET is unset
  (prevents forgeable session cookies / auth bypass).
- Validate playlist names to a safe charset and render sldl configs via
  literal Python substitution instead of sed (closes a command-injection
  and path-traversal path through playlist names).
- shlex-quote credential values written to shell-sourced env files, and
  strip newlines from values patched into .conf files.
- Render playlist .conf files 0600; warn at startup if the master key is
  co-located with the config volume; document keeping it separate.

Portability:
- Configurable timezone via TZ (default UTC) instead of hardcoded Edmonton.
- Remove personal defaults (navidrome user "andrew", ephemeral.club URLs).
- Ship generic example seeds; move the cross-album dedup keep-list and the
  legacy playlist import to editable config files; drop the personal
  _upgrade.csv.
- Generic VPN reference in docker-compose.snippet.yml.

First-run experience:
- Redirect to /setup instead of 500 when OIDC is unconfigured; surface a
  missing master key inline; entrypoint exits with an actionable message
  when the config folder is not writable.
- Add unauthenticated /health (JSON) and /setup (checklist) diagnostics.

Docs:
- Write docs/ARCHITECTURE.md and docs/MIGRATION.md (previously referenced
  but missing); expand README with ownership, backups, advanced settings,
  and migration guidance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pipeline/lib/dedup-library.sh

@@ -407,8 +407,23 @@ log "[$(date -Iseconds)] === Pass 4: cross-album dedup (artist+title-base) ==="
 beet ls -f "\$id${SEP}\$albumartist${SEP}\$album${SEP}\$title${SEP}\$path" \
   2>/dev/null > /tmp/all-tracks.txt
 
-# Pass artist + album allowlists into awk via -v
-CROSS_ALBUM_KEEP_RE='^(porterrobinson|madeon|variousartists)$'
+# Pass artist + album allowlists into awk via -v.
+# The artist keep-list (artists whose same-title tracks across albums are NOT
+# treated as duplicates) is user-editable config, not baked in here. Build the
+# anchored regex from cross-album-keep.list: normalize each name the same way
+# the awk norm() does (lowercase, letters+digits only) and OR them together.
+# An empty/absent list means "protect nobody" -> use a pattern that can never
+# match a normalized name (which only ever contains [a-z0-9], never '_').
+CROSS_ALBUM_KEEP_FILE="${ALEMBIC_CONFIG_DIR:-/config}/pipeline/cross-album-keep.list"
+if [[ -f "$CROSS_ALBUM_KEEP_FILE" ]]; then
+  _keep_names=$(grep -vE '^[[:space:]]*(#|$)' "$CROSS_ALBUM_KEEP_FILE" \
+    | tr 'A-Z' 'a-z' | sed -E 's/[^a-z0-9]//g' | grep -v '^$' | paste -sd'|' -)
+fi
+if [[ -n "${_keep_names:-}" ]]; then
+  CROSS_ALBUM_KEEP_RE="^(${_keep_names})\$"
+else
+  CROSS_ALBUM_KEEP_RE='_never_'
+fi
 # Album-name patterns that indicate "intentional alt version" — these rows are
 # filtered out before grouping, so any group needing 2+ matches will only form
 # from items whose albums DON'T look like remix/live/single-version releases.