feat: add scan status and cover art endpoints

Track scanner status for the web API and Subsonic-compatible scan endpoints, add authenticated cover art serving, and wire album artwork into the web UI. Keep Subsonic auth limited to legacy password mode for now so behavior stays honest with the current bcrypt-based user storage.

apps/web/src/lib/api.ts

@@ -14,6 +14,7 @@ export type HomePayload = {
     title: string
     year: number
     trackCount: number
+    coverArtId: string
   }>
   artists: Array<{
     id: string
@@ -67,3 +68,8 @@ export async function fetchHome() {
 export async function fetchTracks() {
   return request<{ items: Track[] }>('/api/tracks')
 }
+
+export function coverArtUrl(id: string) {
+  const token = useSessionStore.getState().token
+  return `${API_BASE}/api/cover-art/${id}${token ? `?token=${encodeURIComponent(token)}` : ''}`
+}

apps/web/src/pages/home-page.tsx

@@ -1,5 +1,5 @@
 import { useQuery } from '@tanstack/react-query'
-import { fetchHome } from '@/lib/api'
+import { coverArtUrl, fetchHome } from '@/lib/api'
 import { SectionTitle } from '@/components/section-title'
 
 export function HomePage() {
@@ -28,7 +28,15 @@ export function HomePage() {
           <div className="grid gap-4 md:grid-cols-3">
             {home?.recentAlbums.map((album) => (
               <article key={album.id} className="rounded-[24px] border border-line bg-panel p-4">
-                <div className="aspect-square rounded-[20px] bg-[linear-gradient(145deg,#1f2f45,#152236)]" />
+                {album.coverArtId ? (
+                  <img
+                    alt={album.title}
+                    className="aspect-square w-full rounded-[20px] object-cover"
+                    src={coverArtUrl(album.id)}
+                  />
+                ) : (
+                  <div className="aspect-square rounded-[20px] bg-[linear-gradient(145deg,#1f2f45,#152236)]" />
+                )}
                 <div className="mt-4 text-lg font-semibold">{album.title}</div>
                 <div className="text-sm text-slate-400">{album.artistName}</div>
                 <div className="mt-2 text-xs uppercase tracking-[0.22em] text-slate-500">
@@ -57,4 +65,3 @@ export function HomePage() {
     </div>
   )
 }
-