Environment upgrade & hot-cache playback (#463)

* chore: upgrade dependencies and migrate playback to rodio 0.22

Bump npm and Rust crates; adapt symphonia decoding, ringbuf 0.5, lofty tags,
and discord-rich-presence usage. Use native rodio Player/MixerDeviceSink and
cpal device descriptions; drop the unused cpal patch. Align Vite 8 build
targets and chunking; remove redundant dynamic imports and fix hot-cache debug
logging imports.

* perf(build): lazy-load routes and restore default chunk warnings

Lazy-load all routed pages with React.lazy to shrink the main bundle; wrap root
Routes in Suspense for lazy Login. Drop chunkSizeWarningLimit override so Vite
uses the default 500 kB threshold.

* fix(windows): tray double-click without spurious menu; clean unused import

Disable tray menu on left mouse-up on Windows so a double-click to hide the
main window does not immediately reopen the context menu (tray-icon default
menu_on_left_click). Gate std::fs in app_api/core behind cfg(linux) for
/proc-only code so Windows builds stay warning-free.

* fix(sidebar): preserve new-releases read state under storage cap

When merging seen album ids, keep the current newest sample first so the
500-id localStorage limit does not truncate freshly marked reads and bring
back the unread badge.

* fix(audio): hot-cache replay, analysis no-op skips, playback source UI

Retain stream_completed_cache across audio_stop so end-of-queue replay can
use RAM promote or disk hot file instead of re-ranging HTTP.

Add cpu_seed_redundant_for_track gate before file/bytes seeds and local-file
spawn; emit analysis:waveform-updated only on Upserted. Ranged/legacy promote
checks generation after await before filling the slot.

Frontend: promote on same-track and cold resume; set currentPlaybackSource on
resume, queue undo restore, and gapless track switch so cache/stream icons stay
accurate. Import tauri::Manager for try_state in audio_play.

* fix(ts): narrow activeServerId for hot-cache promote calls

promoteCompletedStreamToHotCache expects a string; bind non-null server ids
in repeat-one, playTrack prev/same-track, and cold resume paths so tauri
production build (tsc) succeeds.

* fix(player): handle same-track hot-cache promote promise chain

Add .catch for promoteCompletedStreamToHotCache → runPlayTrackBody so sync
throws and unexpected rejections do not surface as unhandled in DevTools;
reset defer-hot-cache prefetch and isPlaying on failure.

* chore(nix): sync npmDepsHash with package-lock.json

* chore(release): finalize 1.46.0 CHANGELOG with PR #463 links

Document the release with full GitHub PR #463 on every subsection so
entries stay attributable if sections are reordered. Fix ContextMenu
lines where dynamic imports were accidentally merged onto one line.

* docs(contributors): credit cucadmuh for #463

src-tauri/Cargo.toml

@@ -30,38 +30,39 @@ tauri-plugin-dialog = "2"
 tauri-plugin-fs = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-rodio = { version = "0.19", default-features = false, features = ["symphonia-all"] }
+rodio = { version = "0.22", default-features = false, features = ["playback", "symphonia-all"] }
 symphonia = { version = "0.5", default-features = false, features = ["flac", "mp3", "pcm", "aac", "alac", "isomp4", "vorbis", "ogg", "wav", "adpcm"] }
-reqwest = { version = "0.12", default-features = false, features = ["stream", "json", "multipart", "rustls-tls", "rustls-tls-native-roots", "blocking"] }
+reqwest = { version = "0.13", default-features = false, features = ["stream", "json", "multipart", "query", "form", "rustls", "blocking"] }
 futures-util = "0.3"
-md5 = "0.7"
+md5 = "0.8"
 tokio = { version = "1", features = ["rt", "time", "sync"] }
-biquad = "0.4"
-ringbuf = "0.3"
+biquad = "0.6"
+ringbuf = "0.5"
 tauri-plugin-window-state = "2.4.1"
 tauri-plugin-process = "2"
 tauri-plugin-updater = "2"
 souvlaki = { version = "0.8", default-features = false, features = ["use_zbus"] }
-discord-rich-presence = "0.2"
+discord-rich-presence = "1.1"
 url = "2"
-thread-priority = "1"
-lofty = "0.22"
-sysinfo = { version = "0.33", default-features = false, features = ["disk"] }
+thread-priority = "3"
+lofty = "0.24"
+sysinfo = { version = "0.38", default-features = false, features = ["disk"] }
 id3 = "1.16.4"
-symphonia-adapter-libopus = "0.2.7"
-rusqlite = { version = "0.37", features = ["bundled"] }
+symphonia-adapter-libopus = "0.2.9"
+rusqlite = { version = "0.39", features = ["bundled"] }
 ebur128 = "0.1"
+dasp_sample = "0.11.0"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"
 
 [target.'cfg(target_os = "linux")'.dependencies]
-zbus = { version = "5.9", default-features = false, features = ["blocking-api"] }
+zbus = { version = "5.15", default-features = false, features = ["blocking-api"] }
 # Match wry/tauri’s WebKitGTK stack — used only to turn off kinetic wheel scrolling.
 webkit2gtk = { version = "2.0", default-features = false, features = ["v2_40"] }
 
 [target.'cfg(windows)'.dependencies]
-windows = { version = "0.58", features = [
+windows = { version = "0.62", features = [
     "Win32_Foundation",
     "Win32_Graphics",
     "Win32_Graphics_Gdi",
@@ -80,12 +81,3 @@ windows = { version = "0.58", features = [
 #   of failing the entire probe
 symphonia-format-isomp4 = { path = "patches/symphonia-format-isomp4" }
 
-# Local patch for cpal's CoreAudio backend on macOS:
-# - Forces IOType::DefaultOutput for all output streams so that macOS never
-#   triggers the TCC microphone-permission prompt. Upstream cpal uses
-#   IOType::HalOutput when the user pins a non-default device, which routes
-#   through AUHAL — that component is flagged as input-capable and triggers
-#   the mic consent dialog on first launch / after each update.
-# - Tradeoff: output-device selection is a no-op on macOS (stream follows
-#   system default). Surfaced in the Settings UI.
-cpal = { path = "patches/cpal-0.15.3" }