Search Deezer and MusicBrainz together; add preview clips

Search
- Albums and songs search Deezer and MusicBrainz at once and merge the
  results: duplicates keep the Deezer copy, best word matches first.
  Deezer's search misses albums it carries (Death Magnetic) and most game
  soundtracks; MusicBrainz finds them
- MusicBrainz secondary types are shown ("Soundtrack", "Live")
- Settings: Deezer + MusicBrainz (default), Deezer only, MusicBrainz only
- Search results show which service they came from

Previews
- Songs and albums get a play button (cards, rows, detail view, editor,
  and Deezer search results) for a 30-second Deezer clip; albums play
  their most popular track
- Clips are looked up fresh (Deezer URLs expire), cached 10 minutes, and
  streamed through Canon with Range support; hidden lists stay private
- Entries from MusicBrainz or added by hand are matched to Deezer on save
  so they can preview too
- "Play previews" toggle in Settings → Profile

Tests cover merging and title/artist matching; `-tags live` runs checks
against the real services.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/server.go

@@ -43,6 +43,9 @@ type Server struct {
 	assetVer   string
 	loginLimit *auth.Limiter
 	setupCode  string
+
+	previews      previewCache
+	previewClient *http.Client
 }
 
 func New(cfg config.Config, st *store.Store, images *imgcache.Cache, log *slog.Logger, version string) (*Server, error) {
@@ -53,6 +56,8 @@ func New(cfg config.Config, st *store.Store, images *imgcache.Cache, log *slog.L
 		log:        log,
 		assetVer:   version,
 		loginLimit: auth.NewLimiter(10, 15*time.Minute),
+		// No overall timeout: clips stream for as long as the listener plays.
+		previewClient: &http.Client{Transport: &http.Transport{ResponseHeaderTimeout: 15 * time.Second}},
 	}
 	s.providers = providers.NewRegistry(s.credentials)
 	static, err := fs.Sub(web.FS, "static")
@@ -99,6 +104,7 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /{$}", s.handleHome)
 	mux.HandleFunc("GET /l/{slug}", s.handleList)
 	mux.HandleFunc("GET /l/{slug}/export", s.handleExport)
+	mux.HandleFunc("GET /preview/{id}", s.handleItemPreview)
 	mux.HandleFunc("GET /images/{name}", s.handleImage)
 	mux.HandleFunc("GET /custom.css", s.handleCustomCSS)
 	mux.Handle("GET /static/", http.StripPrefix("/static/", s.staticHandler()))
@@ -118,6 +124,7 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /admin", s.requireUser(s.handleAdminLists))
 	mux.HandleFunc("GET /admin/lists/{id}", s.requireUser(s.handleAdminList))
 	mux.HandleFunc("GET /admin/settings", s.requireUser(s.handleAdminSettings))
+	mux.HandleFunc("GET /admin/preview", s.requireUser(s.handleAdminPreview))
 
 	// Admin JSON API
 	api := func(pattern string, h http.HandlerFunc) { mux.HandleFunc(pattern, s.requireAPI(h)) }