fix: A2 (relax art-source CHECK) + D + E integration residual

A2 — migration 0030: the albums/artists art `*_source` CHECK was a
fixed provider-ID allowlist fighting the extensible coverart.Register
registry (per-provider migration churn at 0016/0018/0020; rejected
test stub providers → ~11 enricher tests failed). Relax to "NULL or
non-empty"; the registry is the source of truth. Same brittleness
class as the #433 discovery-mix CHECK.

D — lidarr Approve resolves metadata/quality profiles (JSON arrays)
before the add; the test stubs returned {"id":1} for every path, so
ListMetadataProfiles failed to unmarshal → 500/Approve errors. Make
the lidarrrequests + admin_requests stubs path-aware (arrays for
/metadataprofile, /qualityprofile).

E:
- auth: requireUser (prelude.go) emitted code "auth_required"; the
  canonical code is "unauthenticated" (operator decision). Change the
  code; drop the now-dead "auth_required" web error-copy key
  ("unauthenticated" already has copy).
- playlists_system_test wrapped the real auth.RequireUser middleware
  but only injected withUser() context → 401. Like every other api
  handler test, drop the middleware and rely on requireUser().
- admin_users dup-username test seeded "test-existing" (seedUser
  prefixes) but POSTed "existing" → no collision; POST the prefixed
  name.
- me_timezone test decoded a top-level {"code"} but the envelope is
  {"error":{"code"}}; decode the nested shape.
- audit test asserted compact JSON; Postgres jsonb::text is spaced.
- put-lidarr-config tests predated the missing_defaults gate (correct
  handler behavior); supply the required defaults in the bodies.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/api/admin_lidarr_test.go

@@ -137,8 +137,9 @@ func TestHandlePutLidarrConfig_EmptyKeyPreservesSaved(t *testing.T) {
 		APIKey:  "originalkey",
 	})
 
-	// PUT with empty api_key — should preserve "originalkey".
-	body := []byte(`{"enabled":true,"base_url":"http://lidarr.lan:8686","api_key":""}`)
+	// PUT with empty api_key — should preserve "originalkey". enabled=true
+	// requires the defaults gate (missing_defaults) to be satisfied.
+	body := []byte(`{"enabled":true,"base_url":"http://lidarr.lan:8686","api_key":"","default_quality_profile_id":1,"default_metadata_profile_id":1,"default_root_folder_path":"/music"}`)
 	w := doAdminReq(t, h, http.MethodPut, "/api/admin/lidarr/config", body, admin)
 	if w.Code != http.StatusOK {
 		t.Fatalf("status = %d, want 200; body = %s", w.Code, w.Body.String())
@@ -183,7 +184,7 @@ func TestHandlePutLidarrConfig_HappyPath(t *testing.T) {
 	resetLidarrState(t, h)
 	admin := seedAdminUser(t, h)
 
-	body := []byte(`{"enabled":true,"base_url":"http://lidarr.lan:8686","api_key":"newkey","default_quality_profile_id":2,"default_root_folder_path":"/music"}`)
+	body := []byte(`{"enabled":true,"base_url":"http://lidarr.lan:8686","api_key":"newkey","default_quality_profile_id":2,"default_metadata_profile_id":1,"default_root_folder_path":"/music"}`)
 	w := doAdminReq(t, h, http.MethodPut, "/api/admin/lidarr/config", body, admin)
 	if w.Code != http.StatusOK {
 		t.Fatalf("status = %d, want 200; body = %s", w.Code, w.Body.String())

internal/api/admin_requests_test.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/go-chi/chi/v5"
@@ -174,10 +175,17 @@ func TestHandleApproveRequest_HappyPath(t *testing.T) {
 	h, _ := testHandlersWithClientFn(t)
 	resetLidarrState(t, h)
 
-	stub := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+	stub := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte(`{"id":1}`))
+		switch {
+		case strings.Contains(r.URL.Path, "/metadataprofile"):
+			_, _ = w.Write([]byte(`[{"id":1,"name":"Standard"}]`))
+		case strings.Contains(r.URL.Path, "/qualityprofile"):
+			_, _ = w.Write([]byte(`[{"id":1,"name":"Lossless"}]`))
+		default:
+			_, _ = w.Write([]byte(`{"id":1}`))
+		}
 	}))
 	t.Cleanup(stub.Close)
 
@@ -221,7 +229,14 @@ func TestHandleApproveRequest_OverrideUsed(t *testing.T) {
 		}
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte(`{"id":1}`))
+		switch {
+		case strings.Contains(r.URL.Path, "/metadataprofile"):
+			_, _ = w.Write([]byte(`[{"id":1,"name":"Standard"}]`))
+		case strings.Contains(r.URL.Path, "/qualityprofile"):
+			_, _ = w.Write([]byte(`[{"id":1,"name":"Lossless"}]`))
+		default:
+			_, _ = w.Write([]byte(`{"id":1}`))
+		}
 	}))
 	t.Cleanup(stub.Close)
 

internal/api/admin_users_test.go

@@ -163,7 +163,10 @@ func TestAdminCreateUser_DuplicateUsername_409(t *testing.T) {
 	admin := seedUser(t, pool, "duper", "pw", true)
 	seedUser(t, pool, "existing", "pw", false)
 
-	body := `{"username":"existing","password":"abcd1234"}`
+	// seedUser prefixes usernames with dbtest.TestUserPrefix, so the
+	// row above is "test-existing"; POST that exact name to actually
+	// collide (stays test-prefixed for ResetDB).
+	body := `{"username":"test-existing","password":"abcd1234"}`
 	req := httptest.NewRequest(http.MethodPost, "/api/admin/users", bytes.NewReader([]byte(body)))
 	req = withUser(req, admin)
 	rec := httptest.NewRecorder()

internal/api/me_timezone_test.go

@@ -69,14 +69,18 @@ func TestPutTimezone_InvalidIANA(t *testing.T) {
 		t.Fatalf("status = %d, want 400; body=%s", rec.Code, rec.Body.String())
 	}
 
+	// Error envelope is nested: {"error":{"code":...}} (matches the
+	// rest of /api/*), not a top-level {"code":...}.
 	var errResp struct {
-		Code string `json:"code"`
+		Error struct {
+			Code string `json:"code"`
+		} `json:"error"`
 	}
 	if err := json.NewDecoder(rec.Body).Decode(&errResp); err != nil {
 		t.Fatalf("decode err response: %v", err)
 	}
-	if errResp.Code != "invalid_timezone" {
-		t.Errorf("error code = %q, want invalid_timezone", errResp.Code)
+	if errResp.Error.Code != "invalid_timezone" {
+		t.Errorf("error code = %q, want invalid_timezone", errResp.Error.Code)
 	}
 }
 

internal/api/playlists_system_test.go

@@ -8,8 +8,6 @@ import (
 	"testing"
 
 	"github.com/go-chi/chi/v5"
-
-	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
 )
 
 // Generic registry-driven system-playlist endpoints (#411 R2).
@@ -17,7 +15,11 @@ import (
 func newSystemPlaylistRouter(h *handlers) chi.Router {
 	r := chi.NewRouter()
 	r.Route("/api", func(api chi.Router) {
-		api.Use(auth.RequireUser(h.pool))
+		// No real auth.RequireUser middleware: like every other api
+		// handler test, auth is supplied via withUser() context and the
+		// handlers self-guard with requireUser() (prelude.go). The real
+		// middleware needs a live session and would 401 the injected
+		// test user.
 		api.Post("/playlists/system/{kind}/refresh", h.handleSystemPlaylistRefresh)
 		api.Get("/playlists/system/{kind}/shuffle", h.handleSystemPlaylistShuffle)
 	})

internal/api/prelude.go

@@ -19,7 +19,7 @@ import (
 func requireUser(w http.ResponseWriter, r *http.Request) (dbq.User, bool) {
 	user, ok := auth.UserFromContext(r.Context())
 	if !ok {
-		writeErr(w, apierror.Unauthorized("auth_required", ""))
+		writeErr(w, apierror.Unauthorized("unauthenticated", ""))
 		return dbq.User{}, false
 	}
 	return user, true