Security hardening and first-run/portability improvements

Security (P0):
- Remove committed session-secret default; auto-generate and persist a
  random secret to the config volume when SESSION_SECRET is unset
  (prevents forgeable session cookies / auth bypass).
- Validate playlist names to a safe charset and render sldl configs via
  literal Python substitution instead of sed (closes a command-injection
  and path-traversal path through playlist names).
- shlex-quote credential values written to shell-sourced env files, and
  strip newlines from values patched into .conf files.
- Render playlist .conf files 0600; warn at startup if the master key is
  co-located with the config volume; document keeping it separate.

Portability:
- Configurable timezone via TZ (default UTC) instead of hardcoded Edmonton.
- Remove personal defaults (navidrome user "andrew", ephemeral.club URLs).
- Ship generic example seeds; move the cross-album dedup keep-list and the
  legacy playlist import to editable config files; drop the personal
  _upgrade.csv.
- Generic VPN reference in docker-compose.snippet.yml.

First-run experience:
- Redirect to /setup instead of 500 when OIDC is unconfigured; surface a
  missing master key inline; entrypoint exits with an actionable message
  when the config folder is not writable.
- Add unauthenticated /health (JSON) and /setup (checklist) diagnostics.

Docs:
- Write docs/ARCHITECTURE.md and docs/MIGRATION.md (previously referenced
  but missing); expand README with ownership, backups, advanced settings,
  and migration guidance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pipeline/lib/recover-azuracast-playlists.py

@@ -14,7 +14,7 @@ Default is dry-run. Pass --apply to actually write tags + assign.
 
 Env / args:
   --azuracast-key KEY    AzuraCast API key (required)
-  --azuracast-base URL   default https://admin.ephemeral.club
+  --azuracast-base URL   default from AZURACAST_BASE env (empty if unset)
   --station N            default 1
   --apply                actually act (default is dry-run)
   --only PLAYLIST        limit recovery to one playlist (testing)
@@ -157,7 +157,7 @@ def beet_update(container_paths: list[str], log) -> None:
 def main() -> int:
     ap = argparse.ArgumentParser()
     ap.add_argument("--azuracast-key", required=True)
-    ap.add_argument("--azuracast-base", default="https://admin.ephemeral.club")
+    ap.add_argument("--azuracast-base", default=os.environ.get("AZURACAST_BASE", ""))
     ap.add_argument("--station", type=int, default=1)
     ap.add_argument("--apply", action="store_true")
     ap.add_argument("--only", default=None, help="limit recovery to one playlist name")