feat(api): /api/playlists* handlers for M7 #352 slice 1

9 handlers covering create / get / list / update / delete / append /
remove / reorder / cover. Permissions enforced in the service layer
(ErrForbidden -> 403 not_authorized) so the handler is a thin
HTTP-shape adapter. /cover serves the cached collage from disk via
http.ServeFile; 404 when cover_path is nil.

Server gained a DataDir field so the playlists service can find the
collage cache; api.Mount picks up two new params (playlistsSvc and
dataDir). The stale TestRoutesRegisteredInMount Mount() call in
library_test.go was missing the tracks.Service argument added by an
earlier slice — fixed in passing.

Wire codes follow the project's existing nested errorBody envelope:
not_found, not_authorized, unauthenticated, bad_request, server_error.
The plan called for a flat envelope, but the api package's writeErr
already produces {"error":{"code":"...","message":"..."}} and
deviating here would break every existing client.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/api/api.go

@@ -17,13 +17,14 @@ import (
 	"git.fabledsword.com/bvandeusen/minstrel/internal/lidarrquarantine"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/lidarrrequests"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/playevents"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/playlists"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/tracks"
 )
 
 // Mount attaches /api/* handlers to r. Public endpoints (login) are outside
 // RequireUser; everything else is gated by the middleware. The events writer
 // is shared with the Subsonic mount so /rest/scrobble feeds the same store.
-func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playevents.Writer, recCfg config.RecommendationConfig, lidarrCfg *lidarrconfig.Service, lidarrReqs *lidarrrequests.Service, lidarrQuar *lidarrquarantine.Service, tracksSvc *tracks.Service) {
+func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playevents.Writer, recCfg config.RecommendationConfig, lidarrCfg *lidarrconfig.Service, lidarrReqs *lidarrrequests.Service, lidarrQuar *lidarrquarantine.Service, tracksSvc *tracks.Service, playlistsSvc *playlists.Service, dataDir string) {
 	rng := rand.New(rand.NewSource(rand.Int63()))
 	h := &handlers{
 		pool: pool, logger: logger, events: events, recCfg: recCfg,
@@ -32,6 +33,8 @@ func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playev
 		lidarrRequests:   lidarrReqs,
 		lidarrQuarantine: lidarrQuar,
 		tracks:           tracksSvc,
+		playlists:        playlistsSvc,
+		dataDir:          dataDir,
 	}
 
 	r.Route("/api", func(api chi.Router) {
@@ -98,6 +101,16 @@ func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playev
 
 				admin.Delete("/tracks/{id}", h.handleRemoveTrack)
 			})
+
+			authed.Get("/playlists", h.handleListPlaylists)
+			authed.Post("/playlists", h.handleCreatePlaylist)
+			authed.Get("/playlists/{id}", h.handleGetPlaylist)
+			authed.Patch("/playlists/{id}", h.handleUpdatePlaylist)
+			authed.Delete("/playlists/{id}", h.handleDeletePlaylist)
+			authed.Post("/playlists/{id}/tracks", h.handleAppendTracks)
+			authed.Delete("/playlists/{id}/tracks/{position}", h.handleRemovePlaylistTrack)
+			authed.Put("/playlists/{id}/tracks", h.handleReorderPlaylist)
+			authed.Get("/playlists/{id}/cover", h.handleGetPlaylistCover)
 		})
 	})
 }
@@ -112,4 +125,6 @@ type handlers struct {
 	lidarrRequests   *lidarrrequests.Service
 	lidarrQuarantine *lidarrquarantine.Service
 	tracks           *tracks.Service
+	playlists        *playlists.Service
+	dataDir          string
 }