fix: iTunes route order (lookup before proxy); stable cover art URLs for browser caching

src/api.js

@@ -28,12 +28,29 @@ export async function getLyricsBySongId(songId) {
   } catch { return []; }
 }
 export function downloadUrl(id) { return apiUrl('download', `&id=${id}`); }
+// Stable salt derived from credentials so the browser HTTP cache survives page reloads.
+// Random salt (apiUrl default) changes every session → cache miss every time → art re-fetches.
+let _coverSalt = null, _coverToken = null;
+function _coverAuth() {
+  if (!_coverSalt && S.cfg.user && S.cfg.pass) {
+    _coverSalt  = md5(S.cfg.user + S.cfg.pass).slice(0, 8);
+    _coverToken = md5(S.cfg.pass + _coverSalt);
+  }
+  return _coverSalt ? `u=${encodeURIComponent(S.cfg.user)}&t=${_coverToken}&s=${_coverSalt}` : null;
+}
 export function coverUrl(id, size=300) {
   if (!id) return null;
   const key = `${id}:${size}`;
-  if (!_coverUrlCache.has(key)) _coverUrlCache.set(key, apiUrl('getCoverArt', `&id=${id}&size=${size}`));
+  if (!_coverUrlCache.has(key)) {
+    const auth = _coverAuth();
+    const url = auth
+      ? `${S.cfg.url}/rest/getCoverArt?${auth}&v=1.16.1&c=NovaSonic&f=json&id=${id}&size=${size}`
+      : apiUrl('getCoverArt', `&id=${id}&size=${size}`);
+    _coverUrlCache.set(key, url);
+  }
   return _coverUrlCache.get(key);
 }
+export function invalidateCoverCache() { _coverUrlCache.clear(); _coverSalt = null; _coverToken = null; }
 
 // ─── NAVIDROME REST AUTH ───
 export async function ndAuth() {