Robustness: crash-safe migrations, stale-run sweep, optional prep tools; branded 404

- init_db applies each schema file with executescript (semicolons in triggers
  and string literals no longer break it) and records schema_version itself
  after each file, so a forgotten in-file bump can't re-run an ALTER and crash
  startup. Re-running is a no-op.
- On startup, sweep any job_runs left in 'running' (killed by a restart) to
  'interrupted' so the UI/history don't show a run stuck running forever.
- prep-audio.sh skips loudgain and cue_file cleanly when they aren't installed
  (they aren't in the base image) instead of failing on a missing binary and
  logging errors; pipeline-status.sh routes syslog through a guard so a missing
  `logger` doesn't spew into the job log.
- Add a branded 404 page (rendered to static HTML, no external runtime) via a
  custom exception handler that leaves all other responses, including the login
  redirect, untouched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pipeline/lib/pipeline-status.sh

@@ -43,6 +43,14 @@ mark_info() {                   printf "    %s\n" "$*"; }
 
 section() { printf "\n▎ %s\n" "$*"; }
 
+# syslog / `logger` is not present in the container image. Only call it if it
+# exists, so these lines don't spew "logger: command not found" into the job
+# log on every run. Always returns success.
+slog() {
+  command -v logger >/dev/null 2>&1 || return 0
+  logger -t sldl-pipeline "$@"
+}
+
 # Format an age in seconds as "Nh", "Nd", "Nw", "Nmo".
 human_age() {
   local s=$1
@@ -375,16 +383,16 @@ ${BANNER_TALLY}" "$OUT"
 
 # Always mirror the one-line summary to syslog so journalctl shows last-run
 # state even if Telegram is broken. Warnings get a separate WARN tag.
-logger -t sldl-pipeline "status: $OK ok, $WARN warn, $SKIP skip (see $OUT)"
+slog "status: $OK ok, $WARN warn, $SKIP skip (see $OUT)"
 if (( WARN > 0 )); then
-  logger -t sldl-pipeline "WARN: pipeline-status flagged $WARN issue(s) — see $OUT"
+  slog "WARN: pipeline-status flagged $WARN issue(s) — see $OUT"
 fi
 
 # Send to Telegram. If it fails, log the failure to syslog so the absence of
 # a message in the chat has a corresponding journal entry to grep for.
 if [[ -x ${PIPELINE_DIR:-/app/pipeline}/lib/notify-telegram.sh ]]; then
   if ! ${PIPELINE_DIR:-/app/pipeline}/lib/notify-telegram.sh < "$OUT" 2>/tmp/tg-err; then
-    logger -t sldl-pipeline "WARN: Telegram send failed: $(cat /tmp/tg-err 2>/dev/null | head -c 200)"
+    slog "WARN: Telegram send failed: $(cat /tmp/tg-err 2>/dev/null | head -c 200)"
     rm -f /tmp/tg-err
   fi
 fi

pipeline/lib/prep-audio.sh

@@ -26,25 +26,37 @@ prep_audio() {
     return 0
   fi
 
-  echo "[prep-audio] loudgain (track-mode RG, clip-safe) on ${#files[@]} file(s)" >>"$log"
-  # -q quiet, -k lower track gain to avoid clipping >-1 dBFS,
-  # -s e write extended ReplayGain2 + R128 tags, -I 4 ID3v2.4 for MP3.
-  # No -a, so each file gets its own track gain (track-mode).
-  if ! loudgain -q -k -s e -I 4 "${files[@]}" >>"$log" 2>&1; then
-    echo "[prep-audio] loudgain returned non-zero (see log)" >>"$log"
+  # loudgain (ReplayGain) and cue_file (Liquidsoap autocue) are optional. They
+  # are not in the base image, so only run them if present -- otherwise skip
+  # cleanly with a note instead of failing on a missing binary. Install them in
+  # the image if you want ReplayGain/autocue tags written at prep time.
+  if command -v loudgain >/dev/null 2>&1; then
+    echo "[prep-audio] loudgain (track-mode RG, clip-safe) on ${#files[@]} file(s)" >>"$log"
+    # -q quiet, -k lower track gain to avoid clipping >-1 dBFS,
+    # -s e write extended ReplayGain2 + R128 tags, -I 4 ID3v2.4 for MP3.
+    # No -a, so each file gets its own track gain (track-mode).
+    if ! loudgain -q -k -s e -I 4 "${files[@]}" >>"$log" 2>&1; then
+      echo "[prep-audio] loudgain returned non-zero (see log)" >>"$log"
+    fi
+  else
+    echo "[prep-audio] loudgain not installed, skipping ReplayGain" >>"$log"
   fi
 
-  echo "[prep-audio] cue_file (autocue liq_* tags) on ${#files[@]} file(s)" >>"$log"
-  # -w write tags into file, -k true-peak clipping prevention.
-  # Skips files that already have liq_cue_file=true (use -f to force).
-  local failed=0
-  for f in "${files[@]}"; do
-    if ! cue_file -w -k "$f" >>"$log" 2>&1; then
-      echo "[prep-audio] cue_file failed on $f" >>"$log"
-      failed=$((failed + 1))
-    fi
-  done
-  [[ $failed -gt 0 ]] && echo "[prep-audio] cue_file errors: $failed" >>"$log"
+  if command -v cue_file >/dev/null 2>&1; then
+    echo "[prep-audio] cue_file (autocue liq_* tags) on ${#files[@]} file(s)" >>"$log"
+    # -w write tags into file, -k true-peak clipping prevention.
+    # Skips files that already have liq_cue_file=true (use -f to force).
+    local failed=0
+    for f in "${files[@]}"; do
+      if ! cue_file -w -k "$f" >>"$log" 2>&1; then
+        echo "[prep-audio] cue_file failed on $f" >>"$log"
+        failed=$((failed + 1))
+      fi
+    done
+    [[ $failed -gt 0 ]] && echo "[prep-audio] cue_file errors: $failed" >>"$log"
+  else
+    echo "[prep-audio] cue_file not installed, skipping autocue tags" >>"$log"
+  fi
 
   echo "${#files[@]}"
 }