fix: drift audit batch 1 — six small mechanical wins

Six findings from the 2026-06-02 multi-system drift audit (Scribe
parent task #552):

- **#553 (web)** Tailwind class fix: web admin playback-errors Delete
  confirm button was using `bg-action-danger`, an undefined token —
  swap to `bg-action-destructive` to match every other destructive
  button. Restored the Oxblood signal that distinguishes Delete from
  Cancel.

- **#555 (web)** Type the `source` field on `play_started` in the
  EventRequest discriminated union. Server's eventRequest accepts it;
  web's TS type was missing the slot, so a "drop extra properties"
  refactor could silently strip the source tag and break system-
  playlist rotation attribution.

- **#556 + #557 (server)** Coverage rollup whitelist was pinned to
  ('sidecar','embedded','mbcaa','theaudiodb'); migration 0020 added
  'deezer' and 'lastfm' as valid cover_art_source values but those
  never got wired in, so albums with art from those providers
  silently counted as MISSING in the admin Coverage dashboard. The
  rollup test was seeding only the pre-0020 sources, masking the
  gap in CI. Extend the query to include deezer + lastfm; seed the
  test with one row per valid source (regression-guards future
  additions).

- **#558 (web)** Auth gate was blocking /forgot-password and
  /reset-password/<token> — both are entered without a session by
  definition, so the email-link reset flow was bouncing signed-out
  users to /login. Add /forgot-password to the public set and a
  /reset-password/ prefix matcher. New tests assert both routes
  reach their pages without redirect.

- **#571 (server)** Library scanner was indexing only .mp3/.m4a/.flac
  /.ogg while the stream handler (media.go) had been extended to
  serve .opus, .aac, and .wav. A user with .opus files in their
  library never saw them in artist/album listings because the
  scanner skipped indexing — silent data loss. Aligned the scanner
  to match the media handler.

Scribe statuses updated to in_progress; flipping to done after the
push since these are mechanical and verified directly against the
cited file:lines.

web/src/lib/api/types.ts

@@ -106,7 +106,13 @@ export type LikedIdsResponse = {
 };
 
 export type EventRequest =
-  | { type: 'play_started';  track_id: string; client_id?: string }
+  // `source` is the system-playlist variant the play came from
+  // (for_you, discover, deep_cuts, …); empty/undefined for library
+  // / user-playlist / radio / Subsonic. Server stores it on
+  // play_events.source and uses it to advance the rotation. Drift
+  // #555: the type was missing `source` so callers had no typed slot
+  // for it and a "clean up extra properties" refactor could drop it.
+  | { type: 'play_started';  track_id: string; client_id?: string; source?: string }
   | { type: 'play_ended';    play_event_id: string; duration_played_ms: number }
   | { type: 'play_skipped';  play_event_id: string; position_ms: number };
 

web/src/lib/auth/publicRoutes.test.ts

@@ -30,4 +30,22 @@ describe('isPublicRoute', () => {
     expect(isPublicRoute('/login/extra')).toBe(false);
     expect(isPublicRoute('/loginx')).toBe(false);
   });
+
+  // Regression guard for drift #558: /forgot-password and the
+  // /reset-password/<token> deep links must be reachable without a
+  // session — the reset flow is entered by clicking an email link
+  // while signed out, so the auth gate redirecting to /login broke
+  // account recovery.
+  test('/forgot-password is public', () => {
+    expect(isPublicRoute('/forgot-password')).toBe(true);
+  });
+
+  test('/reset-password/<token> is public', () => {
+    expect(isPublicRoute('/reset-password/abc-123')).toBe(true);
+    expect(isPublicRoute('/reset-password/')).toBe(true);
+  });
+
+  test('/reset-password (no trailing slash) is NOT public — only the token sub-path', () => {
+    expect(isPublicRoute('/reset-password')).toBe(false);
+  });
 });

web/src/lib/auth/publicRoutes.ts

@@ -2,8 +2,15 @@
 // when the visitor is unauthenticated. Bootstrap-admin self-registration
 // (#376) requires /register to be reachable without a session — without
 // /register here, the login page's "Register" link bounces back to /login.
-const PUBLIC_ROUTES = new Set(['/login', '/register']);
+//
+// Drift #558: /forgot-password and /reset-password/<token> were missing
+// from this set. The email-link reset flow is by definition entered
+// without a session — a signed-out user clicking their reset link was
+// being bounced to /login, breaking account recovery.
+const PUBLIC_ROUTES = new Set(['/login', '/register', '/forgot-password']);
+const PUBLIC_PREFIXES = ['/reset-password/'];
 
 export function isPublicRoute(pathname: string): boolean {
-  return PUBLIC_ROUTES.has(pathname);
+  if (PUBLIC_ROUTES.has(pathname)) return true;
+  return PUBLIC_PREFIXES.some((p) => pathname.startsWith(p));
 }

web/src/routes/admin/playback-errors/+page.svelte

@@ -274,7 +274,7 @@
       <button
         type="button"
         onclick={confirmDeleteFile}
-        class="rounded bg-action-danger px-3 py-2 text-sm text-action-fg hover:opacity-90"
+        class="rounded bg-action-destructive px-3 py-2 text-sm text-action-fg hover:opacity-90"
       >Delete file</button>
     </div>
   {/if}