feat(offline): #427 S4a — Shuffle all + offline system-playlist gate

Headline of S4. "Shuffle all" is always present (home app-bar
shuffle icon); the pool degrades with reachability:
- online  → GET /api/library/shuffle?limit=N (new): N random
  library tracks server-side, per-user quarantine filtered
  (ListRandomTracksForUser, ORDER BY random()).
- offline → ShuffleSource shuffles the whole local cache index
  (audio_cache_index ∩ cached_tracks, names from cached_artists/
  albums) — a UNION over liked AND recently-played, since the
  two-bucket split is storage-only and never filters playback.

Offline gating: refreshable (singleton) system playlists need the
live build/shuffle endpoints, so their tile play is disabled when
offlineProvider is true — Shuffle all is the offline path. User
playlists still play from cache.

playlist_card now reads offlineProvider in build → wrapped the
direct-render widget test in ProviderScope (offlineProvider is
smoke-safe from S1: tracked timers, no connectivity mount).

S4b (offline Recently-played / Liked browsable surfaces over the
cache index) next.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/db/queries/tracks.sql

@@ -81,6 +81,23 @@ WHERE t.artist_id = $1
 ORDER BY albums.release_date NULLS LAST, albums.sort_title,
          t.disc_number NULLS FIRST, t.track_number NULLS FIRST, t.id;
 
+-- name: ListRandomTracksForUser :many
+-- #427 S4: backing query for GET /api/library/shuffle — the online
+-- source for "Shuffle all". N random tracks across the whole
+-- library, per-user-quarantine filtered. $1 user_id, $2 limit.
+SELECT sqlc.embed(t),
+       albums.title AS album_title,
+       artists.name AS artist_name
+FROM tracks t
+JOIN albums  ON albums.id  = t.album_id
+JOIN artists ON artists.id = t.artist_id
+WHERE NOT EXISTS (
+      SELECT 1 FROM lidarr_quarantine q
+      WHERE q.user_id = $1 AND q.track_id = t.id
+  )
+ORDER BY random()
+LIMIT $2;
+
 -- name: CountTracksByArtist :one
 -- Used by request-progress reporting to count tracks ingested under a
 -- matched artist (sum across all the artist's albums) while a request