scan progress: core API + UI poller (extracted from #558)

[IrosTheBeggar]

Summary

Extracts the scan-progress refactor and a few small modernizations out of PR #558 (Syncthing + Electron Desktop Player), so they can land independent of the Desktop Player work. The Syncthing/Electron features stay on #558.

Three commits, each independently revertable:

update actions

Workflow version bumps that hadn't already been merged to master. Honors master's deletion of test-ffmpeg-bootstrap.yml.

drop unused deps: axios, winston-daily-rotate-file, make-dir

• axios — POST /api/v1/lastfm/test-login was the last caller; swapped for native fetch (Node ≥22).
• winston-daily-rotate-file — replaced with a small in-process rotator in src/logger.js (opens a fresh file every hour, prunes anything older than 14 days).
• make-dir — makeDirectorySync was the only caller; native fs.mkdirSync(p, { recursive: true }) covers it. Also tightens the playlist-resolver loop in src/api/file-explorer.js and adds a skipped count to the response.

scan progress: core API + UI poller

The actual feature this PR is about. Three problems with the current scan-status flow:

1. The scan_progress table was readable only via GET /api/v1/admin/db/scan/progress, mounted in velvet-stubs.js. On default-UI installs the endpoint didn't exist (velvet-stubs only loaded when ui='velvet'), and it was admin-gated everywhere.
2. The default UI's player polled /api/v1/db/status (coarse locked boolean + total file count) and only set up its 2s interval after seeing locked: true once. A scan triggered after page load went invisible until refresh.
3. The renderer only knew how to write 'Scan In Progress' + a count to two divs. No per-vpath progress, no current-file display.

Server

• src/api/scan.js (NEW) — GET /api/v1/scan/progress. Authenticated but not admin-only. Filters rows to vpaths the caller can see; admins also see pre-vpath 'counting' rows. currentFile is stripped to basename so absolute server paths don't leak.
• src/api/velvet-stubs.js — drops the old /api/v1/admin/db/scan/progress; one comment in its place.
• src/server.js — mounts scanApi alongside the other core APIs (always loaded).

Webapp

• webapp/alpha/scan-progress.js (NEW) — polls every 3s unconditionally. Empty response → empty wrap → no visible UI when idle. Renders a per-vpath card with vpath name, progress bar, percent, scanned/expected counts, current-file as the title attribute.
• webapp/alpha/spa.css — .spc-* rules for the cards (palette adapted to the main UI's colors).
• webapp/index.html — replaces <div id='scan-status'> + <div id='scan-status-files'> with <div id='scan-progress-wrap'>; loads the new script.
• webapp/alpha/m.js — removes the old async dbStatus() + its caller + the unused startInterval. The function wrote to the now-removed scan-status DOM ids and would have thrown on every page load.

MSTREAMAPI.dbStatus and GET /api/v1/db/status are left in place — both are public surface and may have external callers.

Verification

• Lint: no new errors vs. master on any touched file. Fixed two pre-existing prefer-const / no-useless-assignment issues in src/logger.js along the way.
• node --check passes on every changed .js file.
• Behavior (manual smoke): kick a scan from the admin panel after the player is already loaded — cards now appear within 3s and update through the scan; when the scan finishes the cards disappear cleanly. Scrobble flow round-trips a track via the new fetch-based test-login. Logs rotate correctly without winston-daily-rotate-file.

Compatibility

• The new endpoint is at /api/v1/scan/progress — does not collide with any existing route.
• The old admin endpoint is removed; the only known caller (which lived in this same UI) is replaced. Subsonic's separate getScanStatus handler is unchanged.
• MSTREAMAPI.dbStatus and GET /api/v1/db/status are unchanged.

Test plan

• Open the player UI, then trigger a scan from /admin. Within ~3s, a per-vpath card should appear in the navbar with progress.
• Let the scan complete; the card should disappear when scan_progress is cleared by task-queue.js:onScanClose.
• Hit /api/v1/scan/progress directly as a non-admin user — should return rows for that user's vpaths only, with currentFile containing only basenames.
• Configure a Last.fm account via /api/v1/lastfm/test-login — should round-trip without axios installed.
• Boot with writeLogs: true, run for an hour, confirm a new mstream-YYYY-MM-DD-HH.log file rolls over.

🤖 Generated with Claude Code