refactor(api): F.50 — extract 7 small domain modules (#615)

Seven domain-eng splits peel ~200 LOC of read endpoints out of
`api/subsonic.ts`:

- `subsonicStreamUrl.ts` — `buildStreamUrl`, `coverArtCacheKey`,
  `buildCoverArtUrl`, `buildDownloadUrl` (token-signed URL builders
  for the four /rest endpoints we hand to the browser).
- `subsonicStarRating.ts` — `getStarred`, `star`, `unstar`,
  `setRating`, `probeEntityRatingSupport`. `setRating` still triggers
  the lazy `navidromeBrowse` cache invalidation; the same-folder
  lazy import path is preserved.
- `subsonicSearch.ts` — `search`, `searchSongsPaged`.
- `subsonicScrobble.ts` — `scrobbleSong`, `reportNowPlaying`,
  `getNowPlaying`.
- `subsonicAlbumInfo.ts` — `getAlbumInfo2`.
- `subsonicLyrics.ts` — `getLyricsBySongId`.
- `subsonicGenres.ts` — `getGenres`, `getAlbumsByGenre`.

63 external call sites migrated to direct imports. Four `vi.mock`
targets in the store-level tests pointed at `../api/subsonic` and
were updated to the new module paths.

Pure code-move. subsonic.ts: 762 → 561 LOC (−201).

src/api/subsonicStreamUrl.ts

@@ -0,0 +1,51 @@
+import md5 from 'md5';
+import { useAuthStore } from '../store/authStore';
+import { SUBSONIC_CLIENT, secureRandomSalt } from './subsonicClient';
+
+export function buildStreamUrl(id: string): string {
+  const { getBaseUrl, getActiveServer } = useAuthStore.getState();
+  const server = getActiveServer();
+  const baseUrl = getBaseUrl();
+  const salt = secureRandomSalt();
+  const token = md5((server?.password ?? '') + salt);
+  const p = new URLSearchParams({
+    id,
+    u: server?.username ?? '',
+    t: token, s: salt, v: '1.16.1', c: SUBSONIC_CLIENT, f: 'json',
+  });
+  return `${baseUrl}/rest/stream.view?${p.toString()}`;
+}
+
+/** Stable cache key for cover art — does not include ephemeral auth params. */
+export function coverArtCacheKey(id: string, size = 256): string {
+  const server = useAuthStore.getState().getActiveServer();
+  return `${server?.id ?? '_'}:cover:${id}:${size}`;
+}
+
+export function buildCoverArtUrl(id: string, size = 256): string {
+  const { getBaseUrl, getActiveServer } = useAuthStore.getState();
+  const server = getActiveServer();
+  const baseUrl = getBaseUrl();
+  const salt = secureRandomSalt();
+  const token = md5((server?.password ?? '') + salt);
+  const p = new URLSearchParams({
+    id, size: String(size),
+    u: server?.username ?? '',
+    t: token, s: salt, v: '1.16.1', c: SUBSONIC_CLIENT, f: 'json',
+  });
+  return `${baseUrl}/rest/getCoverArt.view?${p.toString()}`;
+}
+
+export function buildDownloadUrl(id: string): string {
+  const { getBaseUrl, getActiveServer } = useAuthStore.getState();
+  const server = getActiveServer();
+  const baseUrl = getBaseUrl();
+  const salt = secureRandomSalt();
+  const token = md5((server?.password ?? '') + salt);
+  const p = new URLSearchParams({
+    id,
+    u: server?.username ?? '',
+    t: token, s: salt, v: '1.16.1', c: SUBSONIC_CLIENT, f: 'json',
+  });
+  return `${baseUrl}/rest/download.view?${p.toString()}`;
+}