fix: drift audit batch 2 — patterned fixes mirroring prior work

Five findings + one cancelled duplicate from the 2026-06-02 drift
audit (Scribe parent task #552):

- **#561 (Android)** PlayerController.playbackErrorEventsChannel was
  Channel.CONFLATED. The PlaybackErrorReporter coroutine reads it in
  a debounce loop that buffers events to coalesce into "Skipped N
  unplayable tracks" — but CONFLATED silently dropped every emission
  except the latest each time the reader wasn't actively pulling.
  A network blip that failed 5 tracks back-to-back surfaced only the
  last failure to the snackbar AND only POSTed one playback_errors
  row to the admin inbox. Switch to BUFFERED (default capacity 64,
  well above any plausible burst rate). Coalescing path now reaches
  N > 1 and the admin inbox sees every failure.

- **#563 (server)** systemPlaylistSources rotation whitelist in
  playevents/writer.go had drifted behind the migrations. It listed
  only for_you + discover; migrations 0021 + 0028 added 6 more
  variants (deep_cuts, rediscover, new_for_you, on_this_day,
  first_listens, songs_like_artist) that ship as refreshable system
  mixes. Plays from those surfaces never advanced the per-user
  rotation, so "unplayed first" ordering staled — the same tracks
  kept resurfacing. Add all 6 to the map; comment now points at the
  migration's CHECK list as the canonical source so future variants
  notice the requirement. #573 was the duplicate auditor hit for
  the same drift; cancelled in Scribe.

- **#564 (Android)** Android emitted source = "playlist:<variant>"
  for system-mix plays from Home and PlaylistDetail, but the
  server's rotation matcher keys on the BARE variant string (web
  sends the bare form — PlaylistCard.svelte:83). Misalignment meant
  system-mix plays from Android never advanced rotation; switching
  from web to Android effectively reset the perceived "unplayed
  next" ordering. Fix HomeScreen.kt:291 to send bare variant and
  PlaylistDetailScreen.kt's play() to prefer systemVariant over the
  playlist:<id> tag when the playlist is a refreshable system mix.
  User playlists keep playlist:<id> (intentional — rotation only
  applies to system mixes anyway).

- **#568 + #569 (Android)** AuthCookieInterceptor was unconditionally
  attaching the Minstrel session cookie to every outgoing request
  AND wiping the session on any 401. The shared OkHttpClient is also
  used by Coil for external image fetches (artwork.musicbrainz.org,
  coverartarchive.org, Lidarr /MediaCover URLs); this leaked the
  session cookie to those hosts (privacy posture) AND silently
  signed users out of Minstrel if any external image host returned
  401. Scope both attach + clear to the placeholder.invalid sentinel
  host the same way BaseUrlInterceptor was scoped in aec10ce7. Two
  new regression tests cover the external-host pass-through. Existing
  tests rewritten to make requests through the placeholder URL so
  they exercise the in-scope path explicitly.

All five Scribe tasks updated to in_progress at start, will flip to
done after CI green on this push.

internal/playevents/writer.go

@@ -69,11 +69,32 @@ func (w *Writer) RecordPlayStarted(
 }
 
 // systemPlaylistSources are the play_events.source values that count
-// against a system playlist's rotation (Fable #415). Add future
-// system-playlist kinds here as they ship (deep_cuts, rediscover, …).
+// against a system playlist's rotation (Fable #415). Mirrors the
+// `playlists_kind_variant_consistent` CHECK in migration
+// 0028_discovery_mix_variants.up.sql — every variant in that CHECK
+// list that ships as a refreshable system mix needs to be here so
+// the rotation reporter sees Android + web plays from that surface.
+//
+// Drift #563: this map drifted behind the migrations. It had only
+// for_you + discover but migrations 0021 + 0028 added 6 more
+// variants. Plays from Rediscover / Deep Cuts / Songs Like X /
+// New for You / On This Day / First Listens didn't advance the
+// per-user rotation, so "unplayed first" ordering staled on those
+// mixes — same tracks kept surfacing.
+//
+// Future variant additions should update this map AND the CHECK in
+// the matching migration in the same change; the
+// `db_check_constraint_for_new_variants` standing rule covers the
+// CHECK half.
 var systemPlaylistSources = map[string]bool{
-	"for_you":  true,
-	"discover": true,
+	"for_you":           true,
+	"discover":          true,
+	"deep_cuts":         true,
+	"rediscover":        true,
+	"new_for_you":       true,
+	"on_this_day":       true,
+	"first_listens":     true,
+	"songs_like_artist": true,
 }
 
 // RecordPlayStartedWithSource is RecordPlayStarted plus a `source`