feat(api): rewrite /api/radio with weighted shuffle v1

Validates seed_track + optional limit (default cfg.Recommendation.RadioSize,
clamped to RadioSizeMax). Calls recommendation.LoadCandidates +
recommendation.Shuffle. Prepends seed to result. Server seeds a
math/rand source at startup; handlers package threads that as a
func() float64 so tests inject deterministic RNGs.

Mount + server.New gain a RecommendationConfig parameter.

internal/api/auth_test.go

@@ -18,6 +18,7 @@ import (
 	"golang.org/x/crypto/bcrypt"
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/config"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/playevents"
@@ -49,7 +50,13 @@ func testHandlers(t *testing.T) (*handlers, *pgxpool.Pool) {
 		t.Fatalf("truncate: %v", err)
 	}
 	w := playevents.NewWriter(pool, logger, 30*time.Minute, 0.5, 30000)
-	return &handlers{pool: pool, logger: logger, events: w}, pool
+	recCfg := config.RecommendationConfig{
+		BaseWeight: 1.0, LikeBoost: 2.0, RecencyWeight: 1.0,
+		SkipPenalty: 1.0, JitterMagnitude: 0.1,
+		RecentlyPlayedHours: 1, RadioSize: 50, RadioSizeMax: 200,
+	}
+	h := &handlers{pool: pool, logger: logger, events: w, recCfg: recCfg, rng: func() float64 { return 0.5 }}
+	return h, pool
 }
 
 func seedUser(t *testing.T, pool *pgxpool.Pool, username, password string, isAdmin bool) dbq.User {