fix(player+lidarr): mini-player sync race; durable approve + dedup

player: setQueueFromTracks fast-starts a single source at player-index 0
while the full queue is broadcast, so the transient currentIndexStream→0
emission clobbered the correct mediaItem with queue.value[0] (the first
track). Mini bar / playlist marker pinned to the wrong track until a
later index event (~the "passive ~30s recovery"). Track a logical-index
base so the player→queue mapping stays correct during the fill window;
also fixes the latent forward-fill auto-advance off-by-base.

lidarr #50: approving no longer fails when Lidarr is down. Approve
records the decision durably first, then best-effort adds; the
reconciler idempotently (re)sends unconfirmed adds every tick until they
stick (new additive lidarr_add_confirmed_at; AddArtist/AddAlbum map
Lidarr's "already exists" 400 → ErrAlreadyExists). No failed-state or
expiry by design — Lidarr keeps trying, operator monitors.

lidarr #51: Create() is now idempotent — a non-terminal request for the
same MBID returns the existing row instead of inserting a duplicate.

Rewrites the obsolete LidarrUnreachable_503 test to assert the durable-
approve contract; threads a client factory into NewReconciler.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/lidarrrequests/service.go

@@ -84,6 +84,23 @@ func (s *Service) Create(ctx context.Context, userID pgtype.UUID, p CreateParams
 		return dbq.LidarrRequest{}, err
 	}
 	q := dbq.New(s.pool)
+	// Dedup: if a non-terminal request for this MBID already exists,
+	// return it instead of inserting a duplicate. The Discover/search UI
+	// already hides requested candidates; this backstops races and direct
+	// API callers so we don't accrue duplicate request rows. Match on the
+	// new request's own-kind MBID (mirrors HasNonTerminalRequestForMBID).
+	dedupMBID := p.LidarrArtistMBID
+	switch p.Kind {
+	case "album":
+		dedupMBID = p.LidarrAlbumMBID
+	case "track":
+		dedupMBID = p.LidarrTrackMBID
+	}
+	if existing, derr := q.GetNonTerminalRequestForMBID(ctx, dedupMBID); derr == nil {
+		return existing, nil
+	} else if !errors.Is(derr, pgx.ErrNoRows) {
+		return dbq.LidarrRequest{}, fmt.Errorf("create: dedup check: %w", derr)
+	}
 	row, err := q.CreateLidarrRequest(ctx, dbq.CreateLidarrRequestParams{
 		UserID:           userID,
 		Kind:             dbq.LidarrRequestKind(p.Kind),
@@ -145,11 +162,14 @@ func (s *Service) ListForUser(ctx context.Context, userID pgtype.UUID, limit int
 	})
 }
 
-// Approve transitions a pending request to approved, snapshotting the
-// chosen quality profile + root folder, then calls Lidarr to actually
-// add the artist/album, then triggers a library scan. If Lidarr returns
-// an error, the request stays pending — the admin sees the error and
-// can retry without losing the request.
+// Approve records the admin's approval DURABLY first (snapshotting the
+// chosen quality profile + root folder), then makes a best-effort Lidarr
+// add and triggers a library scan. The add is no longer a gate: if Lidarr
+// is unreachable the request still becomes approved and the reconciler
+// idempotently (re)sends the add on each tick until it sticks (see
+// sendLidarrAdd + Reconciler.ensureLidarrAdd) — "Lidarr just keeps
+// trying" without the admin re-clicking. Pre-conditions (lidarr disabled,
+// not pending, defaults incomplete) still fail fast before any approval.
 func (s *Service) Approve(ctx context.Context, requestID pgtype.UUID, adminID pgtype.UUID, ov ApproveOverrides) (dbq.LidarrRequest, error) {
 	cfg, err := s.lidarrCfg.Get(ctx)
 	if err != nil {
@@ -182,23 +202,62 @@ func (s *Service) Approve(ctx context.Context, requestID pgtype.UUID, adminID pg
 		return dbq.LidarrRequest{}, ErrDefaultsIncomplete
 	}
 
-	// Lidarr requires a metadata profile id on POST /api/v1/artist (and
-	// on /api/v1/album when it has to create the parent artist). Prefer
-	// the operator's pinned choice from cfg; fall back to fetching the
-	// list and using the first when nothing's been saved yet (operators
-	// upgrading from before metadata-profile support landed).
+	// Record the approval durably FIRST so a Lidarr outage can't lose the
+	// admin's decision. The snapshotted qp/rf also feed the reconciler's
+	// retry, so a deferred add uses exactly what the admin approved with.
+	approved, err := dbq.New(s.pool).ApproveLidarrRequest(ctx, dbq.ApproveLidarrRequestParams{
+		ID:               requestID,
+		QualityProfileID: int32Ptr(qp),
+		RootFolderPath:   strPtr(rf),
+		DecidedBy:        adminID,
+	})
+	if err != nil {
+		return dbq.LidarrRequest{}, fmt.Errorf("approve: persist: %w", err)
+	}
+
+	// Best-effort immediate add for the common (Lidarr-up) path. Any
+	// failure is deliberately swallowed: the request is already durably
+	// approved and the reconciler retries the add on its next tick,
+	// leaving lidarr_add_confirmed_at NULL until it succeeds.
+	if addErr := sendLidarrAdd(ctx, client, cfg, approved); addErr == nil {
+		_ = dbq.New(s.pool).MarkLidarrRequestAddConfirmed(ctx, requestID)
+	}
+	s.scanFn()
+	return approved, nil
+}
+
+// sendLidarrAdd performs the idempotent Lidarr add for an approved
+// request. Used by Service.Approve (best-effort, common path) and by the
+// Reconciler (retry path). qp/rf come from the request's snapshot (set at
+// Approve time) with a config-default fallback; the metadata profile is
+// resolved from config, falling back to Lidarr's first profile for
+// operators who upgraded from before metadata-profile support. Treats
+// lidarr.ErrAlreadyExists as success — the artist/album is already in
+// Lidarr, which is exactly the desired end state.
+func sendLidarrAdd(ctx context.Context, client *lidarr.Client, cfg lidarrconfig.Config, row dbq.LidarrRequest) error {
+	qp := cfg.DefaultQualityProfileID
+	if row.QualityProfileID != nil && *row.QualityProfileID != 0 {
+		qp = int(*row.QualityProfileID)
+	}
+	rf := cfg.DefaultRootFolderPath
+	if row.RootFolderPath != nil && *row.RootFolderPath != "" {
+		rf = *row.RootFolderPath
+	}
+	if qp == 0 || rf == "" {
+		return ErrDefaultsIncomplete
+	}
 	mdProfileID := cfg.DefaultMetadataProfileID
 	if mdProfileID == 0 {
 		mdProfiles, mdErr := client.ListMetadataProfiles(ctx)
 		if mdErr != nil {
-			return dbq.LidarrRequest{}, fmt.Errorf("approve: list metadata profiles: %w", mdErr)
+			return fmt.Errorf("list metadata profiles: %w", mdErr)
 		}
 		if len(mdProfiles) == 0 {
-			return dbq.LidarrRequest{}, fmt.Errorf("approve: no metadata profiles configured in lidarr")
+			return fmt.Errorf("no metadata profiles configured in lidarr")
 		}
 		mdProfileID = mdProfiles[0].ID
 	}
-
+	var err error
 	switch row.Kind {
 	case dbq.LidarrRequestKindArtist:
 		err = client.AddArtist(ctx, lidarr.AddArtistParams{
@@ -224,22 +283,10 @@ func (s *Service) Approve(ctx context.Context, requestID pgtype.UUID, adminID pg
 			RootFolderPath:    rf,
 		})
 	}
-	if err != nil {
-		return dbq.LidarrRequest{}, fmt.Errorf("approve: lidarr add: %w", err)
+	if err != nil && !errors.Is(err, lidarr.ErrAlreadyExists) {
+		return err
 	}
-
-	approved, err := dbq.New(s.pool).ApproveLidarrRequest(ctx, dbq.ApproveLidarrRequestParams{
-		ID:               requestID,
-		QualityProfileID: int32Ptr(qp),
-		RootFolderPath:   strPtr(rf),
-		DecidedBy:        adminID,
-	})
-	if err != nil {
-		// Lidarr accepted but our DB update failed; admin should retry.
-		return dbq.LidarrRequest{}, fmt.Errorf("approve: persist: %w", err)
-	}
-	s.scanFn()
-	return approved, nil
+	return nil
 }
 
 // Reject transitions a pending request to rejected, recording notes and