Aurora SpotiRip production status

Completed
- Spotify authorization-code OAuth with CSRF state validation and refresh-token support.
- Production callback route at /spotify/callback.
- Current-account connection/disconnection state.
- Current user's owned/collaborative playlist picker.
- Spotify playlist URL parsing and February-2026 /playlists/{id}/items API support.
- Real playlist metadata, artwork, tracks, pagination, filtering, and Spotify attribution links.
- Web Playback SDK device setup plus play/pause/previous/next/seek/volume and live now-playing metadata.
- AudD music recognition using short browser-generated fingerprint snippets instead of full-file uploads.
- Editable/manual metadata fallback for recognition misses.
- ID3 title, artist, album, year, track and artwork writing.
- Safe duplicate filename handling; originals are never overwritten.
- Persistent File System Access API output-directory handle in IndexedDB with download fallback.
- Local audio conversion to MP3 using Mediabunny + @mediabunny/mp3-encoder.
- Standalone /convert workflow with 128/192/256/320 kbps options.
- /settings defaults for filename templates, bitrate, artwork, and automatic match selection.
- Flat Web 2.0 visual redesign and dead-control cleanup.
- Typecheck clean.
- Server-side spotdl downloads: single tracks as MP3, playlists as a zip named after the playlist, sent to the visitor's browser and deleted from the server afterwards.
- Browser-tested WAV → MP3 conversion and ID3 metadata round-trip.
- AudD backend connectivity tested; unrecognized audio returns a clean no-match result.

Remaining before launch
- Final responsive/browser smoke test on all routes after the mobile redesign.
- Final server/browser log review.
- Real Spotify OAuth/playback verification after the self-hosted production server is live.
- Deploy the app on the self-hosted server (see docs/self-hosting.md).
- Configure the self-hosted runtime with SPOTIRIP_BASE_URL, SPOTIFY_CLIENT_ID, SPOTIFY_CLIENT_SECRET and AUDD_API_TOKEN.
- Keep Spotify redirect URI set to https://spotirip.auroradragon.dev/spotify/callback.
- Replace the open download access (SPOTIRIP_DOWNLOAD_USERS="*") with site logins once user accounts exist.