v3 library: multi-candidate cover picker — select from a populated list (#732)

* v3 library: multi-candidate cover picker — select from list, media-server style

Auto-best already ships; this adds the "pick from a populated list" surface
Christian asked for, as ONE reusable component (song covers now; album/artist
art reuse the same picker later).

Server:
- GET /api/song/{filename}/art/candidates — assembles WITHOUT hoarding: the
  Current image + its provenance, Pack art when present, and Cover Art Archive
  candidates for the matched release (and any release ids stored on a review
  row's candidates). New _caa_release_index() fetches the CAA release INDEX
  json (image list + types + thumb sizes) through the existing throttle +
  offline gate, cached as caa_index_{id}.json beside the covers (indexes are
  stable). Capped at 12; fetched on demand. Demo-blocked (it spends the rate
  budget) and offline → instant tiles only, no error.

Frontend: new static/v3/image-picker.js — window.__fbOpenImagePicker({filename,
title}), a body-appended singleton modal (match-review anatomy: overlay, focus
trap, Esc). Current image + provenance badge on the left; a tile grid on the
right whose instant tiles — Current, Pack original, Upload, Paste URL — work
immediately even offline, while CAA candidates load behind ONE /art/candidates
fetch with skeleton tiles + a "the source is rate-limited" caption. The fetch
is tied to an AbortController and cancelled when the modal closes.

Applying a pick reuses EXISTING routes so there's no new write path and the
design's key trick holds: a chosen cover POSTs to …/art/url (the override
lane — never evicted by the art-cache LRU, survives a re-match); "Pack
original" DELETEs the override; Upload POSTs …/art/upload (GIF stays
upload-only + local-only). Silent-on-success; the drawer/card art refreshes
via the existing cache-buster.

Entry points: the Details drawer art click (the old direct file dialog is now
the Upload tile) and a card ⋮ "Change cover…" action.

Tests: tests/test_art_candidates.py (matched row lists index images; review
row pulls in candidate releases; unmatched/offline → instant tiles only;
index cached, no second fetch; demo blocked) over a fake index seam.
30 pass with test_art_layer green (same seams). node --check clean; tailwind
rebuilt for the new file.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nm7tHs1Yvjjtnnu4nzJgdN

* fix(v3 cover picker): uiPrompt over window.prompt, visible-only focus trap, gate CAA to matched rows, index-cache lock, abort-on-reopen; +traversal tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: byrongamatos <xasiklas@gmail.com>

static/v3/songs.js

@@ -894,6 +894,7 @@
             // right-click) share this list, so parity is structural.
             ...(state.provider === 'local' && song.filename ? [
                 { id: '__fixmatch', label: 'Fix match…' },
+                { id: '__cover', label: 'Change cover…' },
                 { id: '__refreshmeta', label: 'Refresh metadata' },
                 { id: '__getinfo', label: 'Get info…' },
                 { id: '__remove', label: 'Remove from library', destructive: true },
@@ -941,6 +942,10 @@
             // not the group representative. (__remove stays on `song`: it needs
             // the group's work_key/chart_count and pre-ticks the shown chart.)
             if (id === '__fixmatch') { if (window.__fbFixMatch) window.__fbFixMatch(playTarget); return; }
+            if (id === '__cover') {
+                if (window.__fbOpenImagePicker) window.__fbOpenImagePicker({ filename: playTarget.filename, title: playTarget.title || playTarget.filename });
+                return;
+            }
             if (id === '__refreshmeta') {
                 // Silent on success (hearing-safe, like the rest of the match
                 // layer) — the re-match trickles in through the normal pass.
@@ -2670,7 +2675,18 @@
 
         const artWrap = $('[data-det-art]'); const artFile = $('#det-art-file');
         if (artWrap && artFile) {
-            artWrap.addEventListener('click', () => artFile.click());
+            // Art click opens the cover PICKER (PR-C) — the old direct file
+            // dialog lives on inside it as the Upload tile. The picker applies
+            // immediately (its own routes + refresh), so it bypasses the
+            // drawer's Save; the file-input path below stays as the fallback
+            // when image-picker.js isn't loaded.
+            artWrap.addEventListener('click', () => {
+                if (window.__fbOpenImagePicker) {
+                    window.__fbOpenImagePicker({ filename: song.filename, title: song.title || song.filename });
+                } else {
+                    artFile.click();
+                }
+            });
             artFile.addEventListener('change', () => {
                 const f = artFile.files && artFile.files[0]; if (!f) return;
                 const rd = new FileReader();