fix(backend): Metadaten-Edit trifft nicht mehr die falsche Datei

Findet das Backend die von Navidrome gemeldete Datei nicht am angegebenen Pfad
(Subsonic liefert oft einen aus Tags gebauten virtuellen Pfad), sucht es ueber
Dateiname bzw. Kuenstler+Titel weiter. Liegt derselbe Song mehrfach auf der
Platte, konnte das die falsche Kopie treffen: die wurde getaggt, der bearbeitete
Song blieb unveraendert — die Aenderung "sprang zurueck". Das erklaert, warum es
bei Songs ohne Dublette immer ging und bei anderen nie.

Der ueber Aehnlichkeit gefundene Kandidat wird jetzt per ffprobe gegen die Tags
geprueft, die Navidrome fuer diesen Song meldet, und bei Widerspruch mit 409 und
erklaerender Meldung abgebrochen statt geraten. Zusaetzlich melden uebersprungene
Umbenennungen und Verschiebungen sich als Warnung, statt stumm zu bleiben; die
Antwort nennt den tatsaechlich bearbeiteten Pfad, der Editor zeigt beides an.

Ausserdem: -dontwarn org.slf4j.** — der Release-APK-Build brach seit laengerem an
R8 ab (Ktors Logging referenziert den slf4j-1.x-Binder, den es auf Android nicht
gibt). Vorbestehend, mit HEAD~1 verifiziert.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,11 @@
+# Frontend build context (root Dockerfile) — keep it to what `vite build` needs.
+.git
+node_modules
+dist
+android
+docs
+scripts
+backend
+scrobble
+.env
+*.log

.env.example

@@ -1,20 +1,36 @@
-# Copy to .env and fill in your values
+# Copy to .env next to your docker-compose file and fill in.  cp .env.example .env
+# Used by docker-compose.yml (zieht fertige Images) und docker-compose.dev.yml (baut lokal).
+# REGISTRY/TAG unten braucht nur der Pull-Weg (docker-compose.yml).
 
-# Pre-fills the URLs on the setup screen
+# ── URLs pre-filled on the frontend setup screen ─────────────────────────────
-NAVIDROME_URL=https://music.yourdomain.com
+NAVIDROME_URL=https://music.example.com
-BACKEND_URL=https://novasonic-api.yourdomain.com
+BACKEND_URL=https://backend.example.com
-SCROBBLE_URL=https://novasonic-scrobble.yourdomain.com   # play-log / stats service (port 3710)
+SCROBBLE_URL=https://scrobble.example.com
 
-# Absolute path to your Navidrome music library on the host
+# ── Library / downloads (backend) ────────────────────────────────────────────
-MUSIC_PATH=/srv/navidrome/music
+# Absolute music path — mounted 1:1 into the backend (no remapping), same value inside the container.
-
+MUSIC_PATH=/opt/navidrome/music
-AUDIO_FMT=mp3          # mp3 | flac | opus | best  (used by yt-dlp)
+AUDIO_FMT=mp3
-AUDIO_QUALITY=0        # 0 = best quality           (used by yt-dlp)
+AUDIO_QUALITY=0
 MAX_PARALLEL=2
-
 DOWNLOAD_BACKEND=ytdlp
-
-# Ticketmaster Events (optional — free API key)
-# 1. Sign up at https://developer.ticketmaster.com/
-# 2. Create an app — copy the Consumer Key
 TICKETMASTER_API_KEY=
+
+# ── Android APK download button + in-app updater ─────────────────────────────
+# The backend proxies the fixed Gitea release ("apk-latest") over the LAN, so Gitea can stay internal.
+GITEA_URL=http://192.168.2.51:3000       # Gitea-Basis, die der BACKEND-CONTAINER erreicht.
+                                         # Muss nicht Giteas eigene ROOT_URL sein — das Backend baut
+                                         # die Asset-URL auf diesen Host um (Test aus dem Container:
+                                         # curl -sI $GITEA_URL/api/v1/version).
+GITEA_REPO=Docker/NovaSonic
+GITEA_TOKEN=                              # read token (only needed for a private repo)
+GITEA_APK_TAG=apk-latest
+
+# ── Fertige Images (nur docker-compose.yml) ──────────────────────────────────
+# REGISTRY = where `npm run push-images` pushed to and where the host pulls from.
+#   Gitea container registry (lowercase owner):  gitea.honeyy.duckdns.org/docker
+#   Docker Hub:                                  docker.io/youruser
+# Plain-HTTP internal registries need the host's Docker daemon to allow it
+# (/etc/docker/daemon.json → {"insecure-registries":["192.168.2.51:3000"]}).
+REGISTRY=gitea.honeyy.duckdns.org/docker
+TAG=latest

.gitignore

@@ -3,3 +3,5 @@
 node_modules/
 dist/
 scripts/.env.release
+.env
+.idea/

CHANGELOG.md

@@ -36,6 +36,8 @@ Versioning: two-part `MAJOR.MINOR` — each release bumps the minor (features an
 | Playlist create/edit             | ✅        | ✅      |
 | Playlist cover upload            | ✅        | ✅      |
 | Spotify / YouTube importer       | ✅        | ✅      |
+| Playlist aus Import anlegen      | ✅        | ✅      |
+| Song von Festplatte löschen      | ✅        | ✅      |
 | Metadata editor (tags + cover)   | ✅        | ❌      |
 | Song delete (from disk)          | ✅        | ❌      |
 | Import notification              | ✅        | ✅      |
@@ -64,6 +66,101 @@ Versioning: two-part `MAJOR.MINOR` — each release bumps the minor (features an
 
 ---
 
+## [2.3] — 2026-09-04
+
+### Fixed
+- **YT-Music-Suche war praktisch tot** — `getYtmVideoUrls` verwarf die komplette Trefferliste, sobald
+  irgendwo ein Kanal-Eintrag (`browse/UC…`) auftauchte, samt der bereits gesammelten Song-URLs. An
+  acht echten Suchen gemessen passierte das in **sieben** Fällen: Schritt 1 der Kaskade — die Stufe
+  mit den offiziellen Art Tracks — lieferte nie etwas, faktisch lief jeder Download über den
+  YouTube-Fallback. Das erklärt eine ganze Serie falscher Treffer (u. a. „Easy" als Mixtape- statt
+  Albumversion). Kanal- und Album-Einträge werden jetzt übersprungen statt abzubrechen; über 20 000
+  Zufallsausgaben geprüft ist die neue Auswahl eine Obermenge der alten, kann also nur Kandidaten
+  hinzufügen.
+- **Zurück im Album führte in die Albenliste** — statt dorthin, wo man das Album angeklickt hatte.
+  Der Knopf navigierte vorwärts, legte dabei einen History-Eintrag an und brachte so auch den
+  Browser-Zurück-Knopf durcheinander. Jetzt geht er einen Schritt im Verlauf zurück wie jede andere
+  Detailseite.
+- **Metadaten bearbeiten zerlegte die Hörstatistik** — Top-Titel gruppierten nach `song_id`, und beim
+  Bearbeiten umbenannte Dateien bekommen von Navidrome eine neue ID: der Titel erschien doppelt mit
+  geteilten Zählern, Künstler ebenso bei geänderter Schreibweise. Gruppiert wird jetzt über einen
+  normalisierten Schlüssel (Titel + Künstler), Anzeigenamen kommen aus dem jüngsten Play. Playlists
+  waren nie betroffen, die werden beim Bearbeiten ohnehin auf die neue ID übertragen.
+- **Downloader grabbed a same-shaped title with a different number** — searching DAT ADAM's
+  "700 Main Street" saved **"777 Main Street" by an unrelated artist**. `buildTitleKeywords` required
+  only the two longest words (Street, Main); "700" was dropped for being short, and the cascade step
+  that widens to the top 10 no longer checks the artist channel, so nothing else caught it. Numbers
+  are now always required keywords. In the same pass, a small abbreviation map (street/st, saint/st,
+  mount/mt, doctor/dr, versus/vs, number/no) lets a candidate spelled "700 Main St" match a release
+  titled "700 Main Street" — that mismatch had rejected the correct official Art Track in every step,
+  which is why the search fell through to the wrong video in the first place. A re-release year next
+  to a qualifier ("… - 2020 Remaster") is exempt from the number rule: it appears on the release but
+  never in the YouTube title. Measured against a 29-title sample, 24 titles keep their previous
+  behaviour exactly.
+- **Downloader saved a concert recording as the album track** — searching DAT ADAM's "UFO" stored
+  "Dat Adam - Ufo Video Days 2015 Live". It passed every gate legitimately: right channel, 209 s
+  inside the duration window, "Ufo" in the title, and `!is_live` rejects only *running streams*, not
+  live recordings. The variant blocklist (remix/cover/acoustic/…) now includes `live`. As with the
+  other rules it switches itself off when the searched title says live, so "Live Forever" and
+  deliberately requested live versions are unaffected.
+- **Album-Position im Web wurde doch nicht wiederhergestellt** — die gespeicherte Scrollposition wurde
+  in genau einem `requestAnimationFrame` gesetzt. Solange Cover und Listeneinträge noch nachluden, war
+  `scrollHeight` kleiner als das Ziel, und der Browser kappte den Wert stillschweigend: man landete
+  wieder oben. Der Wert wird jetzt über bis zu ~0,5 s erneut gesetzt, bis er sitzt.
+
+- **Metadaten-Änderungen „sprangen zurück" — bei manchen Songs immer, bei anderen nie.** Findet das
+  Backend die von Navidrome gemeldete Datei nicht am angegebenen Pfad (Navidrome liefert oft einen
+  aus Tags gebauten *virtuellen* Pfad), sucht es über Dateiname bzw. Künstler+Titel weiter. Liegt
+  derselbe Song mehrfach auf der Platte — etwa ein Fehlgriff des Downloaders neben der richtigen
+  Datei —, konnte das die **falsche Kopie** treffen: die wurde getaggt, der bearbeitete Song blieb
+  unverändert. Genau deshalb ging es bei Songs ohne Dublette immer und bei anderen nie. Der über
+  Ähnlichkeit gefundene Kandidat wird jetzt gegen die Tags geprüft, die Navidrome für den Song
+  meldet, und bei Widerspruch mit einer erklärenden Meldung abgebrochen, statt zu raten.
+- **Stumm übersprungene Umbenennungen** — lag am Zielnamen schon eine Datei, blieb der Song unter
+  altem Namen bzw. im alten Ordner liegen, ohne Hinweis. Solche Fälle kommen jetzt als Warnung
+  zurück; der Editor zeigt sie samt bearbeitetem Dateipfad an und bleibt offen.
+
+### Added
+- **Android: Songs von der Festplatte löschen** — im Song-Kontextmenü, unten abgesetzt und rot, mit
+  derselben Sicherheitsabfrage wie im Web. Nutzt denselben Backend-Endpunkt (`/api/delete-song`) und
+  erscheint nur, wenn ein Backend konfiguriert ist — Navidrome allein kann keine Dateien entfernen.
+- **Android: Playlist direkt aus dem Import anlegen** — der Importer hat jetzt wie das Web ein
+  Häkchen „Playlist daraus anlegen" samt Namensfeld (ab zwei Titeln). Nach dem Download stößt er
+  Navidromes Scan an, sucht jeden Titel und legt die Playlist aus den gefundenen an; nicht
+  gefundene werden gezählt statt die Erstellung scheitern zu lassen.
+
+Zusätzlich zum Auslieferungsteil dieser Version: production **pulls pre-built images** instead of
+compiling on the server, the **APK download works again** (it had been broken by Gitea's own link
+host), and the scroll memory from 2.2 finally behaves on the Alben tab.
+
+### Added (Auslieferung)
+- **Pull-based production stack** — `docker-compose.yml` now references
+  `${REGISTRY}/novasonic-frontend|-backend|-scrobble:${TAG:-latest}` and builds nothing on the host:
+  `docker compose pull && docker compose up -d`. Building locally from the Dockerfiles moved to
+  `docker-compose.dev.yml` (no registry needed there). Images are pushed from the dev machine with
+  `npm run push-images`. A `.dockerignore` keeps the frontend build context to what `vite build`
+  needs, so `android/`, `backend/` and `.git` no longer travel into the image.
+
+### Fixed
+- **APK download failed with "Keine APK hinterlegt"** — Gitea builds `browser_download_url` from its
+  own `ROOT_URL`, which pointed at a host the backend cannot reach (a leftover from an earlier
+  network). The API call succeeded, so the download button appeared, but fetching the asset ran into
+  the dead address and fell back silently to a local file that does not exist. Asset and redirect
+  URLs are now rewritten onto `GITEA_URL`; if the Gitea path still fails, a warning log and the 404
+  body name both sources that were tried instead of claiming no APK exists.
+- **Alben tab jumped back to the top on Back (Android)** — `LaunchedEffect(state.albumSort)` scrolled
+  to item 0. That effect runs on first composition too, not only on a sort change, so returning from
+  an album discarded the position the ViewModel had correctly kept. Scrolling to the top now happens
+  in `LibraryViewModel.setAlbumSort()`, on a real sort change only.
+
+### Changed
+- **APK release at versionCode 3** — carries the Alben-tab fix above and, for the first time in a
+  published build, the artist-page and "Alle anzeigen" overlay scroll/search memory (2.2 shipped the
+  code, but the release APK predated it). Signed with the established debug key, so it installs
+  in place over versionCode 2 and app data survives.
+
+---
+
 ## [2.2] — 2026-08-22
 
 A cleanup-and-parity release: the **Song Importer moves into the Global Search field** (one field,

CLAUDE.md

@@ -41,9 +41,22 @@ npm run build    # production build → dist/
 npm run preview  # preview the production build
 ```
 
-Backend runs in Docker (see `docker-compose.yml`); on the deploy host it lives at
+Der Stack läuft in Docker. **`docker-compose.yml` ist der Normalfall und zieht fertige Images**
-`/opt/navidrome/music`. Restart after backend changes: `docker compose restart novasonic-backend`
+(`${REGISTRY}/novasonic-frontend|-backend|-scrobble:${TAG:-latest}`) — der Server baut nichts:
-(this also re-pulls the latest yt-dlp).
+`docker compose pull && docker compose up -d`. Ein einfacher Restart ist `docker compose restart
+novasonic-backend` (das Backend zieht bei jedem Start das neueste yt-dlp nach).
+
+Gepusht wird von der Dev-Maschine mit `npm run push-images` (`scripts/build-push-images.mjs`, liest
+`REGISTRY`/`TAG` aus `.env`); ohne Node tut es direkt `docker build -t $REGISTRY/<name>:latest
+<context>` + `docker push` mit den Kontexten `.`, `backend/`, `scrobble/`. Registry ist die
+Gitea-Registry (`…/docker`, Owner klein geschrieben).
+
+**`docker-compose.dev.yml`** ist die Variante, die stattdessen lokal aus den Dockerfiles baut
+(`backend/Dockerfile` + `scrobble/Dockerfile`), ohne Registry: `docker compose -f
+docker-compose.dev.yml up -d --build`. Die schweren Deps (ffmpeg, Deno, yt-dlp, node libs) sind in
+den Images gebacken, deshalb sind **Restarts sofort da** und Rebuilds nach `git pull` cache-schnell.
+
+On the deploy host the music lives at `/opt/navidrome/music`.
 
 ## Download pipeline (hard-won knowledge)
 
@@ -80,6 +93,31 @@ Backend runs in Docker (see `docker-compose.yml`); on the deploy host it lives a
   matches, download **nothing** and fail cleanly with "Nicht eindeutig gefunden — bitte
   Direktlink im Importer nutzen". Never fall back to a blind title-only/no-filter grab — it
   pulled same-titled covers by other uploaders, and wrong Piano Echoes for Japanese tracks.
+- **Numbers in a title are always required keywords.** `buildTitleKeywords` kept only the two
+  LONGEST words, and numbers are short — so "700 Main Street" was filtered on Street+Main only and
+  the cascade happily saved **"777 Main Street" by a different artist** (step 3 drops the channel
+  check, so nothing else caught it). Numeric tokens are now emitted as `\b<n>\b` in addition to the
+  two longest words. Same fix carries a small abbreviation map (street/st, saint/st, mount/mt,
+  doctor/dr, versus/vs, number/no): uploaders write "700 Main St" where the release says "Street",
+  which had rejected the correct official Art Track in every step. One exception: a **re-release year
+  next to a qualifier** ("… - 2020 Remaster") is dropped again — it sits on the release but never in
+  the YouTube title, so requiring it would reject the correct upload. A title that IS a year ("1999",
+  "Berlin 2020") keeps it. Unit-tested in `backend/test/ytdlp.test.js`.
+- **Live recordings are excluded by title, not by `is_live`.** `!is_live` only means "not a running
+  stream" — a concert RECORDING passes it. On the artist's own channel nothing else distinguishes it
+  from the studio track, which is how "Dat Adam - Ufo Video Days 2015 Live" (channel `Dat Adam`,
+  209 s, title contains UFO) got saved as the album track. `buildVariantFilter` therefore carries a
+  `live` rule like remix/cover/…. It self-disables when the searched title itself says live, so
+  "Live Forever" or a deliberately requested live version still works — that check uses a `\blive\b`
+  regex (`skipRe`), because a plain substring test would let "deliver"/"delivery" switch the rule off.
+- **A channel hit in the YTM results is a line to skip, not a reason to abort.** `getYtmVideoUrls`
+  used to treat any `/browse/UC…` in the output as "yt-dlp expanded an artist channel" and returned
+  `[]` — discarding the song URLs it had already collected. Measured on 8 real searches, that fired
+  in **7 of 8**, so step 1 (YTM, where the official Art Tracks live) was effectively dead and almost
+  every download came from the YouTube fallback. With `--flat-playlist` a channel is printed as ONE
+  line, so expansion cannot happen; `pickYtmVideoUrls()` now keeps every `watch?v=` line and skips
+  `browse/UC…` (channel) and `browse/MPREb_…` (album) alike. It is a strict superset of the old
+  behaviour — fuzz-checked over 20k random outputs — so it can only add candidates, never remove any.
 - **Size cap:** `--max-filesize 30M` on every yt-dlp call; Mittelweg steps also cap at 2×
   expected duration. Prevents saving a 28-min video (52 MB) when the wrong result slips through.
 - **Leading aesthetic characters:** artists often style their name with leading punctuation

README.md

@@ -87,7 +87,8 @@ NovaSonic/
 ├── styles.css
 ├── vite.config.js
 ├── Dockerfile
-├── docker-compose.yml
+├── docker-compose.yml         # Standard: zieht die fertigen Images aus der Registry
+├── docker-compose.dev.yml     # Variante: baut lokal aus den Dockerfiles
 ├── nginx.conf
 └── docker-entrypoint.sh       # Injects NAVIDROME_URL / BACKEND_URL / SCROBBLE_URL at runtime
 ```
@@ -123,9 +124,25 @@ TICKETMASTER_API_KEY=  # optional — free key from developer.ticketmaster.com
 ### 2. Start
 
 ```bash
+docker compose pull
 docker compose up -d
 ```
 
+Zieht die drei fertigen Images aus der Registry — nichts wird auf dem Server gebaut. Dafür in der
+`.env` `REGISTRY` (und optional `TAG`) setzen; die Images heißen
+`$REGISTRY/novasonic-frontend|-backend|-scrobble`. Neue Stände lädt man von der Dev-Maschine mit
+`npm run push-images` hoch (bzw. `docker build -t $REGISTRY/<name>:latest <context> && docker push …`
+— Kontexte: `.` (frontend), `backend/`, `scrobble/`).
+
+**Selbst bauen statt ziehen** (keine Registry nötig):
+
+```bash
+docker compose -f docker-compose.dev.yml up -d --build
+```
+
+Baut lokal aus den Dockerfiles; die Deps stecken in den Images, also sind Restarts sofort da und
+Rebuilds nach einem `git pull` dank Layer-Cache schnell.
+
 Frontend on port 8080, backend on port 3700, scrobble service on port 3710. Route each through your reverse proxy. **Important:** the scrobble subdomain must *not* sit behind an SSO / forward-auth gateway — it authenticates itself via Navidrome (`ping.view`), and a gateway in front redirects the app's API calls to a login page.
 
 ### 3. First launch

android/app/build.gradle.kts

@@ -14,7 +14,7 @@ android {
         applicationId = "com.novasonic.app"
         minSdk        = 26
         targetSdk     = 35
-        versionCode   = 1
+        versionCode   = 3
         versionName   = "1.0"
     }
 

android/app/proguard-rules.pro

@@ -6,3 +6,9 @@
 # Keep Media3 session / exoplayer classes used by reflection / service binding.
 -keep class androidx.media3.** { *; }
 -keep class com.google.android.exoplayer2.** { *; }
+
+# Ktors Logging referenziert ueber slf4j den Binder aus slf4j 1.x. Auf Android existiert der nicht
+# (slf4j 2.x sucht Implementierungen per ServiceLoader, und wir binden ohnehin keine), deshalb bricht
+# R8 den Release-Build mit "Missing class org.slf4j.impl.StaticLoggerBinder" ab. Die Referenz ist zur
+# Laufzeit unerreichbar — slf4j faengt das Fehlen selbst ab und schaltet auf einen No-op-Logger.
+-dontwarn org.slf4j.**

android/app/src/main/kotlin/com/novasonic/app/api/ImporterClient.kt

@@ -8,6 +8,7 @@ import io.ktor.client.plugins.*
 import io.ktor.client.plugins.contentnegotiation.*
 import io.ktor.client.request.*
 import io.ktor.http.*
+import io.ktor.http.isSuccess
 import io.ktor.serialization.kotlinx.json.*
 import kotlinx.serialization.json.Json
 
@@ -54,5 +55,18 @@ class ImporterClient(private val backendUrl: String) {
     suspend fun status(jobId: String): DownloadStatus =
         http.get("${base()}/api/status/$jobId").body()
 
+    /**
+     * Loescht einen Song endgueltig von der Platte — derselbe Endpunkt, den der Web-Client nutzt.
+     * Das Backend braucht die Navidrome-Zugangsdaten, weil es den Dateipfad ueber getSong aufloest.
+     * Wirft bei HTTP != 2xx (Ktor `expectSuccess` ist hier aus, deshalb der explizite Check).
+     */
+    suspend fun deleteSong(ndUrl: String, user: String, pass: String, songId: String) {
+        val res = http.post("${base()}/api/delete-song") {
+            contentType(ContentType.Application.Json)
+            setBody(DeleteSongRequest(ndUrl.trimEnd('/'), user, pass, songId))
+        }
+        if (!res.status.isSuccess()) error("HTTP ${res.status.value}")
+    }
+
     fun close() = http.close()
 }

android/app/src/main/kotlin/com/novasonic/app/api/SubsonicClient.kt

@@ -163,6 +163,9 @@ class SubsonicClient(
     suspend fun addSongToPlaylist(playlistId: String, songId: String) =
         getList("updatePlaylist.view", listOf("playlistId" to playlistId, "songIdToAdd" to songId))
 
+    /** Stoesst Navidromes Bibliotheks-Scan an — nach einem Import, damit frische Dateien auffindbar sind. */
+    suspend fun startScan() = get("startScan.view")
+
     suspend fun createPlaylist(name: String, songIds: List<String> = emptyList()): com.novasonic.app.api.model.PlaylistWithSongs {
         val params = mutableListOf("name" to name)
         songIds.forEach { params += "songId" to it }

android/app/src/main/kotlin/com/novasonic/app/api/model/ImporterModels.kt

@@ -42,6 +42,15 @@ data class DownloadRequest(
 @Serializable
 data class ResolveRequest(val url: String)
 
+/** Body fuer POST {backend}/api/delete-song — loescht die Datei von der Platte (wie im Web). */
+@Serializable
+data class DeleteSongRequest(
+    val ndUrl: String,
+    val user: String,
+    val pass: String,
+    val songId: String,
+)
+
 /** Response from GET {backend}/api/status/{jobId} */
 @Serializable
 data class DownloadStatus(

android/app/src/main/kotlin/com/novasonic/app/data/MusicRepository.kt

@@ -106,6 +106,7 @@ class MusicRepository(private val context: Context) {
     suspend fun getSongsByGenre(genre: String)          = api().getSongsByGenre(genre)
     suspend fun addSongToPlaylist(playlistId: String, songId: String) = api().addSongToPlaylist(playlistId, songId)
     suspend fun createPlaylist(name: String, songIds: List<String>)   = api().createPlaylist(name, songIds)
+    suspend fun startScan()                                           = api().startScan()
     suspend fun updatePlaylistMeta(playlistId: String, name: String, comment: String? = null) = api().updatePlaylistMeta(playlistId, name, comment)
     suspend fun removeSongsFromPlaylist(playlistId: String, indices: List<Int>) = api().removeSongsFromPlaylist(playlistId, indices)
     suspend fun deletePlaylist(playlistId: String) = api().deletePlaylist(playlistId)

android/app/src/main/kotlin/com/novasonic/app/ui/AppNavigation.kt

@@ -128,6 +128,7 @@ fun AppNavigation() {
     var contextMenuSong    by remember { mutableStateOf<Song?>(null) }
     var playlistPickerSong by remember { mutableStateOf<Song?>(null) }
     var infoSheetSong      by remember { mutableStateOf<Song?>(null) }
+    var songToDelete       by remember { mutableStateOf<Song?>(null) }
     var showNotifications  by remember { mutableStateOf(false) }
     var selectedAbsItem by remember { mutableStateOf<AbsLibraryItem?>(null) }
     var showAbsPlayer   by remember { mutableStateOf(false) }
@@ -582,6 +583,44 @@ fun AppNavigation() {
                     Toast.makeText(context, "Download gestartet: ${song.title}", android.widget.Toast.LENGTH_SHORT).show()
                     contextMenuSong = null
                 },
+                // Nur mit Backend: das Loeschen laeuft ueber /api/delete-song, Navidrome allein
+                // kann keine Dateien entfernen.
+                onDelete = if (appSettings.backendUrl.isNotBlank()) {
+                    { songToDelete = song; contextMenuSong = null }
+                } else null,
+            )
+        }
+
+        // Sicherheitsabfrage vor dem endgueltigen Loeschen — Wortlaut wie im Web.
+        songToDelete?.let { song ->
+            AlertDialog(
+                onDismissRequest = { songToDelete = null },
+                title = { Text("Song löschen") },
+                text  = { Text("\"${song.title}\" wird unwiderruflich von der Festplatte gelöscht. " +
+                               "Leere Album- und Künstlerordner werden ebenfalls entfernt.") },
+                confirmButton = {
+                    TextButton(onClick = {
+                        songToDelete = null
+                        scope.launch {
+                            val creds = repo.lastCredentials
+                            val client = com.novasonic.app.api.ImporterClient(appSettings.backendUrl)
+                            val res = runCatching {
+                                client.deleteSong(creds?.serverUrl ?: "", creds?.username ?: "",
+                                                  creds?.password ?: "", song.id)
+                            }
+                            client.close()
+                            Toast.makeText(
+                                context,
+                                res.fold({ "🗑 \"${song.title}\" gelöscht" },
+                                         { "Löschen fehlgeschlagen: ${it.message}" }),
+                                Toast.LENGTH_LONG,
+                            ).show()
+                            // Navidrome braucht einen Moment zum Nachscannen, dann die Ansicht neu laden.
+                            if (res.isSuccess) { kotlinx.coroutines.delay(3000); homeRefreshKey++ }
+                        }
+                    }) { Text("Löschen", color = MaterialTheme.colorScheme.error) }
+                },
+                dismissButton = { TextButton(onClick = { songToDelete = null }) { Text("Abbrechen") } },
             )
         }
 

android/app/src/main/kotlin/com/novasonic/app/ui/component/SongContextSheet.kt

@@ -33,6 +33,7 @@ fun SongContextSheet(
     onGoToAlbum: (() -> Unit)? = null,
     onShowInfo: (() -> Unit)? = null,
     onDownload: (() -> Unit)? = null,
+    onDelete: (() -> Unit)? = null,
 ) {
     ModalBottomSheet(
         onDismissRequest = onDismiss,
@@ -79,6 +80,15 @@ fun SongContextSheet(
             onDownload?.let  { CtxItem(Icons.Default.Download, "Herunterladen",    onClick = { onDismiss(); it() }) }
         }
 
+        // Loeschen steht bewusst unten, abgesetzt und rot: es entfernt die Datei unwiderruflich von
+        // der Platte. Die Sicherheitsabfrage sitzt beim Aufrufer, wie im Web auch.
+        onDelete?.let {
+            HorizontalDivider(color = NsBorder, modifier = Modifier.padding(vertical = 4.dp))
+            CtxItem(Icons.Default.DeleteForever, "Von Festplatte löschen",
+                tint = MaterialTheme.colorScheme.error,
+                onClick = { onDismiss(); it() })
+        }
+
         Spacer(Modifier.height(24.dp))
     }
 }

android/app/src/main/kotlin/com/novasonic/app/ui/screen/ArtistDetailScreen.kt

@@ -215,11 +215,14 @@ fun ArtistDetailScreen(
             title   = openAllAlbums ?: "",
             entries = allAlbumEntries,
             onBack  = { openAllAlbums = null },
+            gridState     = vm.allAlbumsGrid,
+            query         = vm.allAlbumsQuery.value,
+            onQueryChange = { vm.allAlbumsQuery.value = it },
         )
         return
     }
 
-    LazyColumn(Modifier.fillMaxSize()) {
+    LazyColumn(state = vm.pageListState, modifier = Modifier.fillMaxSize()) {
         // Back link
         item {
             Row(
@@ -624,8 +627,10 @@ internal fun AllAlbumsOverlay(
     title: String,
     entries: List<AllAlbumEntry>,
     onBack: () -> Unit,
+    gridState: androidx.compose.foundation.lazy.grid.LazyGridState = androidx.compose.foundation.lazy.grid.rememberLazyGridState(),
+    query: String = "",
+    onQueryChange: (String) -> Unit = {},
 ) {
-    var query by remember { mutableStateOf("") }
     val filtered = remember(query, entries) {
         if (query.isBlank()) entries
         else entries.filter { it.name.contains(query, ignoreCase = true) }
@@ -660,11 +665,11 @@ internal fun AllAlbumsOverlay(
         // Search bar
         OutlinedTextField(
             value = query,
-            onValueChange = { query = it },
+            onValueChange = onQueryChange,
             placeholder = { Text("Suchen…", color = NsOnSurface2) },
             leadingIcon  = { Icon(Icons.Default.Search, null, tint = NsOnSurface2) },
             trailingIcon = if (query.isNotEmpty()) { {
-                IconButton(onClick = { query = "" }) {
+                IconButton(onClick = { onQueryChange("") }) {
                     Icon(Icons.Default.Clear, null, tint = NsOnSurface2)
                 }
             } } else null,
@@ -684,6 +689,7 @@ internal fun AllAlbumsOverlay(
         )
 
         LazyVerticalGrid(
+            state = gridState,
             columns = GridCells.Fixed(2),
             contentPadding = PaddingValues(horizontal = 16.dp, vertical = 8.dp),
             horizontalArrangement = Arrangement.spacedBy(12.dp),

android/app/src/main/kotlin/com/novasonic/app/ui/screen/ExploreScreen.kt

@@ -145,6 +145,9 @@ fun ExploreScreen(
                     allAlbumsOpen        = state.artistAllAlbums,
                     onOpenAllAlbums      = vm::openArtistAllAlbums,
                     onCloseAllAlbums     = vm::closeArtistAllAlbums,
+                    allAlbumsGrid          = vm.allAlbumsGrid,
+                    allAlbumsQuery         = vm.allAlbumsQuery.value,
+                    onAllAlbumsQueryChange = { vm.allAlbumsQuery.value = it },
                 )
             }
         }

android/app/src/main/kotlin/com/novasonic/app/ui/screen/ImporterScreen.kt

@@ -182,6 +182,38 @@ fun ImporterScreen(onBack: () -> Unit) {
                     }
                 }
 
+                // Playlist aus dem Import anlegen — wie im Web-Importer. Nur ab zwei Titeln sinnvoll;
+                // ein einzelner Track ergibt keine Playlist.
+                if (r.tracks.size > 1) {
+                    item {
+                        Column(Modifier.fillMaxWidth().padding(bottom = 10.dp)) {
+                            Row(verticalAlignment = Alignment.CenterVertically) {
+                                Checkbox(
+                                    checked = state.createPlaylist,
+                                    onCheckedChange = vm::setCreatePlaylist,
+                                    colors = CheckboxDefaults.colors(checkedColor = brand,
+                                        checkmarkColor = Color.Black),
+                                )
+                                Text("Playlist daraus anlegen", fontFamily = Outfit, fontSize = 14.sp,
+                                    color = NsOnSurface)
+                            }
+                            if (state.createPlaylist) {
+                                OutlinedTextField(
+                                    value = state.playlistName.ifBlank { r.name ?: "" },
+                                    onValueChange = vm::setPlaylistName,
+                                    label = { Text("Playlist-Name", fontFamily = Outfit) },
+                                    singleLine = true,
+                                    modifier = Modifier.fillMaxWidth().padding(top = 4.dp),
+                                )
+                            }
+                            state.playlistStatus?.let {
+                                Text(it, fontFamily = Outfit, fontSize = 12.sp, color = NsOnSurface2,
+                                    modifier = Modifier.padding(top = 6.dp))
+                            }
+                        }
+                    }
+                }
+
                 // Download button / job progress
                 item {
                     if (state.isDownloading || state.jobStatus == "done" || state.jobStatus == "error") {

android/app/src/main/kotlin/com/novasonic/app/ui/screen/ItunesArtistScreen.kt

@@ -109,6 +109,9 @@ fun ItunesArtistScreen(
     allAlbumsOpen: String?,
     onOpenAllAlbums: (String) -> Unit,
     onCloseAllAlbums: () -> Unit,
+    allAlbumsGrid: androidx.compose.foundation.lazy.grid.LazyGridState = androidx.compose.foundation.lazy.grid.rememberLazyGridState(),
+    allAlbumsQuery: String = "",
+    onAllAlbumsQueryChange: (String) -> Unit = {},
 ) {
     val artist = artistState.artist
     val cats   = if (!artistState.isLoading)
@@ -144,6 +147,9 @@ fun ItunesArtistScreen(
             title   = allAlbumsOpen,
             entries = allAlbumEntries,
             onBack  = onCloseAllAlbums,
+            gridState     = allAlbumsGrid,
+            query         = allAlbumsQuery,
+            onQueryChange = onAllAlbumsQueryChange,
         )
         return
     }

android/app/src/main/kotlin/com/novasonic/app/ui/screen/LibraryScreen.kt

@@ -7,9 +7,7 @@ import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.foundation.lazy.grid.GridCells
 import androidx.compose.foundation.lazy.grid.LazyVerticalGrid
 import androidx.compose.foundation.lazy.grid.items
-import androidx.compose.foundation.lazy.grid.rememberLazyGridState
 import androidx.compose.foundation.lazy.items
-import androidx.compose.foundation.lazy.rememberLazyListState
 import androidx.compose.foundation.pager.HorizontalPager
 import androidx.compose.foundation.pager.rememberPagerState
 import androidx.compose.foundation.shape.CircleShape
@@ -167,7 +165,9 @@ fun LibraryScreen(
                     }
                 }
                 val albumGridState = vm.albumsGridState  // hoisted → survives album drill-in/back
-                LaunchedEffect(state.albumSort) { albumGridState.scrollToItem(0) }
+                // Kein LaunchedEffect(state.albumSort) zum Hochscrollen: der liefe auch beim ersten
+                // Compose nach dem Zurückkommen und würde die gemerkte Position sofort verwerfen.
+                // Das Hochscrollen passiert jetzt in vm.setAlbumSort(), also nur bei echtem Wechsel.
                 LazyVerticalGrid(
                     state   = albumGridState,
                     columns = GridCells.Adaptive(minSize = 150.dp),

android/app/src/main/kotlin/com/novasonic/app/viewmodel/ArtistViewModel.kt

@@ -70,6 +70,12 @@ class ArtistViewModel(app: Application, savedState: SavedStateHandle) : AndroidV
     private val _state = MutableStateFlow(ArtistUiState())
     val state: StateFlow<ArtistUiState> = _state
 
+    // Scroll of the artist page + the "alle anzeigen" overlay, hoisted so tapping an album/artist and
+    // coming back returns you to the same spot (the artist route entry, hence this VM, is retained).
+    val pageListState    = androidx.compose.foundation.lazy.LazyListState()
+    val allAlbumsGrid    = androidx.compose.foundation.lazy.grid.LazyGridState()
+    val allAlbumsQuery   = androidx.compose.runtime.mutableStateOf("")
+
     init {
         if (artistId.isNullOrBlank()) {
             _state.value = ArtistUiState(isLoading = false, error = "Keine Künstler-ID übergeben")

android/app/src/main/kotlin/com/novasonic/app/viewmodel/ExploreViewModel.kt

@@ -79,6 +79,10 @@ class ExploreViewModel(app: Application) : AndroidViewModel(app) {
 
     // Global-search results scroll — hoisted so it survives an album/artist drill-in and back.
     val searchListState = LazyListState()
+    // "Alle anzeigen" overlay (Deezer artist albums): scroll + search query, hoisted so an album
+    // drill-in and back keeps both (the overlay itself leaves composition on drill-in).
+    val allAlbumsGrid  = androidx.compose.foundation.lazy.grid.LazyGridState()
+    val allAlbumsQuery = androidx.compose.runtime.mutableStateOf("")
 
     private var searchJob: Job? = null
 

android/app/src/main/kotlin/com/novasonic/app/viewmodel/ImporterViewModel.kt

@@ -29,6 +29,11 @@ data class ImporterUiState(
     val jobTotal: Int = 0,
     // 30s preview — synthetic id (previewUrl hash) of the clip currently playing, or null
     val previewingId: Long? = null,
+
+    // Playlist aus dem Import anlegen (wie im Web-Importer). Nur sinnvoll ab zwei Titeln.
+    val createPlaylist: Boolean = true,
+    val playlistName: String = "",
+    val playlistStatus: String? = null,
 )
 
 class ImporterViewModel(app: Application) : AndroidViewModel(app) {
@@ -69,6 +74,9 @@ class ImporterViewModel(app: Application) : AndroidViewModel(app) {
 
     fun stopPreview() = preview.stop()
 
+    fun setCreatePlaylist(v: Boolean) { _state.value = _state.value.copy(createPlaylist = v) }
+    fun setPlaylistName(v: String)    { _state.value = _state.value.copy(playlistName = v) }
+
     fun onLink(v: String) {
         _state.value = _state.value.copy(
             link = v,
@@ -173,6 +181,11 @@ class ImporterViewModel(app: Application) : AndroidViewModel(app) {
                 )
                 if (st.status == "done" || st.status == "error") {
                     _state.value = _state.value.copy(isDownloading = false)
+                    val cur = _state.value
+                    if (st.status == "done" && cur.createPlaylist && cur.resolved!!.tracks.size > 1) {
+                        buildPlaylist(cur.playlistName.ifBlank { cur.resolved.name ?: "Import" },
+                                      cur.resolved.tracks)
+                    }
                     return
                 }
             }
@@ -182,6 +195,47 @@ class ImporterViewModel(app: Application) : AndroidViewModel(app) {
         }
     }
 
+    /**
+     * Legt nach dem Import eine Navidrome-Playlist aus den importierten Titeln an — dieselbe Abfolge
+     * wie im Web: Scan anstossen, kurz warten, jeden Titel suchen, gefundene IDs in eine neue
+     * Playlist. Titel, die Navidrome (noch) nicht kennt, werden gezaehlt statt zu scheitern.
+     */
+    private suspend fun buildPlaylist(name: String, tracks: List<ImportTrack>) {
+        _state.value = _state.value.copy(playlistStatus = "Navidrome scannt…")
+        runCatching { repo.startScan() }
+        delay(4000)
+
+        val norm = { s: String -> s.lowercase().replace(Regex("[^\\p{L}\\p{N}]+"), "") }
+        val ids = mutableListOf<String>()
+        var fehlend = 0
+        for (t in tracks) {
+            val titel = t.trackName ?: continue
+            val treffer = runCatching {
+                val q = listOfNotNull(t.artistName, titel).joinToString(" ")
+                val gefunden = repo.search(q).song
+                gefunden.firstOrNull { norm(it.title) == norm(titel) }
+                    ?: repo.search(titel).song.firstOrNull { norm(it.title) == norm(titel) }
+            }.getOrNull()
+            if (treffer != null) ids += treffer.id else fehlend++
+            _state.value = _state.value.copy(
+                playlistStatus = "Playlist: ${ids.size}/${tracks.size} gefunden…")
+        }
+
+        if (ids.isEmpty()) {
+            _state.value = _state.value.copy(
+                playlistStatus = "Keine Titel in Navidrome gefunden — Playlist nicht angelegt.")
+            return
+        }
+        val res = runCatching { repo.createPlaylist(name, ids) }
+        _state.value = _state.value.copy(
+            playlistStatus = res.fold(
+                { "Playlist \"$name\" angelegt: ${ids.size}/${tracks.size} Titel" +
+                  if (fehlend > 0) " ($fehlend nicht gefunden)" else "" },
+                { "Playlist fehlgeschlagen: ${it.message}" },
+            ),
+        )
+    }
+
     private fun mapError(code: String): String = when (code) {
         "EDITORIAL_PLAYLIST" ->
             "Editorial Playlist: Spotify sperrt eigene kuratierte Playlists. Kopiere sie in eine eigene Playlist und importiere diese."

android/app/src/main/kotlin/com/novasonic/app/viewmodel/LibraryViewModel.kt

@@ -45,7 +45,12 @@ class LibraryViewModel(app: Application) : AndroidViewModel(app) {
     init { loadPlaylists() }
 
     fun setAlbumSort(sort: AlbumSort) {
+        if (sort == _state.value.albumSort) return
         _state.value = _state.value.copy(albumSort = sort)
+        // Eine andere Sortierung heißt eine andere Liste — dort oben anfangen. Bewusst hier und
+        // nicht als LaunchedEffect im Screen: der feuert auch bei jedem Neu-Composen (z. B. nach
+        // dem Zurück aus einem Album) und hätte die gemerkte Scrollposition jedes Mal verworfen.
+        viewModelScope.launch { albumsGridState.scrollToItem(0) }
     }
 
     fun selectTab(tab: LibraryTab) {

backend/Dockerfile

@@ -0,0 +1,32 @@
+# NovaSonic download backend — bakes the heavy deps (ffmpeg, Deno, yt-dlp, node libs) so restarts are
+# instant instead of re-installing everything on every boot. Build context = ./backend.
+FROM node:22-slim
+
+# System deps: python (yt-dlp), ffmpeg (tagging/convert), curl/git/unzip (installers), ca-certs.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        python3 python3-pip ffmpeg curl git unzip ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# yt-dlp (nightly) + the Spotify helper tooling.
+RUN pip install --break-system-packages -U --pre 'yt-dlp[default]' \
+    && pip install --break-system-packages spotapi 'git+https://github.com/TzurSoffer/spotify-downloader'
+
+# Deno — yt-dlp uses it to solve YouTube's JS signature/nsig challenge.
+RUN curl -fsSL https://deno.land/install.sh | sh
+ENV PATH="/root/.deno/bin:${PATH}"
+
+# Node libs the server loads (express, kuromoji) — kept out of the app dir like the compose setup did.
+WORKDIR /deps
+RUN npm install express kuromoji
+ENV NODE_PATH=/deps/node_modules
+
+# App code.
+WORKDIR /app
+COPY . /app/
+
+ENV PORT=3700 DATA_PATH=/data
+EXPOSE 3700
+
+# Refresh yt-dlp on start (heavy deps already baked, so this is a quick pull) — non-fatal if offline,
+# the baked version still works. Keeps the "always-latest yt-dlp" behaviour of the old compose command.
+CMD ["sh","-c","pip install --break-system-packages -U --pre 'yt-dlp[default]' >/dev/null 2>&1 || true; node novasonic-server.js"]

backend/lib/ytdlp.js

@@ -26,14 +26,57 @@ function buildTitleKeywords(title) {
     .replace(/[^\w\s]/g, ' ')
     .split(/\s+/)
     .filter(w => w.length >= 3 && !VARIANT_WORDS.has(w.toLowerCase()) && !STOPWORDS.has(w.toLowerCase()));
-  const top2 = words.sort((a, b) => b.length - a.length).slice(0, 2);
+  // Numbers are the most distinctive token a title has and they are usually SHORT, so the
-  const toPattern = w => (w.length >= 4 && w.endsWith('s')) ? w + '?' : w;
+  // longest-two rule threw them away: "700 Main Street" kept only Street+Main and happily matched
-  const result = top2.map(toPattern);
+  // "777 Main Street" by a different artist. Numbers are therefore always required, on top of the
+  // two longest words.
+  // Ausnahme: die Jahreszahl einer Neuauflage ("… - 2020 Remaster") steht auf der Veroeffentlichung,
+  // aber nie im YouTube-Titel — als Pflicht-Keyword wuerde sie den richtigen Upload ablehnen. Nur
+  // wenn ein solches Qualifier-Wort daneben steht; ein Titel, der SELBST eine Jahreszahl ist
+  // ("1999", "Berlin 2020"), behaelt sie.
+  const RELEASE_QUALIFIER = /\b(remaster|remastered|version|edition|anniversary|mono|stereo)\b/i;
+  const isEditionYear = w => /^(19|20)\d{2}$/.test(w) && RELEASE_QUALIFIER.test(title || '');
+  const isRequiredNum = w => /^\d+$/.test(w) && !isEditionYear(w);
+  const numbers = words.filter(isRequiredNum);
+  const wordsNoNum = words.filter(w => !isRequiredNum(w));
+  const top2 = wordsNoNum.sort((a, b) => b.length - a.length).slice(0, 2);
+  // Uploaders abbreviate the same word the release spells out ("700 Main St" vs "700 Main Street"),
+  // which rejected the official Art Track in every cascade step. Accept either spelling; \b keeps
+  // the short form from matching inside another word.
+  const ABBREV = { street: 'st', saint: 'st', mount: 'mt', doctor: 'dr', versus: 'vs', number: 'no' };
+  const toPattern = w => {
+    const abbr = ABBREV[w.toLowerCase()];
+    if (abbr) return `\\b(?:${w}|${abbr})\\b`;
+    return (w.length >= 4 && w.endsWith('s')) ? w + '?' : w;
+  };
+  const result = [...numbers.map(n => `\\b${n}\\b`), ...top2.map(toPattern)];
   const qualifier = lower.includes('mix') ? MIX_QUALIFIERS.find(q => lower.includes(q)) : null;
   if (qualifier && !top2.some(w => w.toLowerCase() === qualifier)) result.push(qualifier);
   return result;
 }
 
+// Aus der YTM-Suchausgabe (--flat-playlist --print webpage_url) die Song-URLs herausziehen.
+// Eine Suche liefert drei Sorten Zeilen: watch?v=… (ein Song), browse/MPREb_… (ein Album) und
+// browse/UC… (ein Kuenstlerkanal). Nur die erste ist ein Kandidat; die anderen beiden sind
+// Listeneintraege und werden uebersprungen.
+//
+// Frueher galt eine browse/UC-Zeile als "yt-dlp hat einen Kanal aufgeklappt" und die GESAMTE
+// Trefferliste wurde verworfen — auch die bereits gesammelten Songs davor. Bei "DAT ADAM UFO" stand
+// der Kanal auf Platz 9 und riss sieben gute Treffer mit, darunter den offiziellen Art Track auf
+// Platz 1; uebrig blieb der YouTube-Fallback, der einen Live-Mitschnitt zog. Aufklappen kann hier
+// ohnehin nicht passieren: mit --flat-playlist druckt yt-dlp einen Kanal als EINE Zeile.
+function pickYtmVideoUrls(stdout) {
+  const urls = [];
+  let skipped = 0;
+  for (const line of (stdout || '').split('\n')) {
+    const u = line.trim();
+    if (!u) continue;
+    if (u.includes('watch?v=')) urls.push(u);
+    else if (u.includes('/browse/')) skipped++;
+  }
+  return { urls, skipped };
+}
+
 function buildVariantFilter(title) {
   const t = (title || '').toLowerCase();
   // !~= (?i) = case-insensitive regex "does not match". Use \b word boundaries so that
@@ -50,8 +93,16 @@ function buildVariantFilter(title) {
     { key: 'cover',        expr: 'title !~= (?i)\\bcover\\b' },
     { key: 'acoustic',     expr: 'title !~= (?i)\\bacoustic\\b' },
     { key: 'instrumental', expr: 'title !~= (?i)\\binstrumental\\b' },
+    // Konzertmitschnitte: `!is_live` heisst nur "laeuft nicht gerade als Stream" und laesst eine
+    // Live-AUFNAHME durch. Auf dem echten Kuenstlerkanal ist die sonst nicht vom Studiotrack zu
+    // unterscheiden — so landete "Dat Adam - Ufo Video Days 2015 Live" in der Bibliothek.
+    // skipRe statt includes(): "deliver"/"delivery" enthalten "live" als Teilstring und wuerden
+    // die Regel sonst faelschlich abschalten.
+    { key: 'live', expr: 'title !~= (?i)\\blive\\b', skipRe: /\blive\b/i },
   ];
-  const parts = RULES.filter(r => !t.includes(r.key)).map(r => r.expr);
+  // Eine Regel entfaellt, wenn der GESUCHTE Titel das Wort selbst traegt — wer "Live Forever" oder
+  // bewusst eine Live-Version sucht, soll sie auch bekommen.
+  const parts = RULES.filter(r => r.skipRe ? !r.skipRe.test(t) : !t.includes(r.key)).map(r => r.expr);
   return parts.length ? parts.join(' & ') : '';
 }
 
@@ -202,14 +253,10 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
   // actual video URLs (watch?v=…). This prevents yt-dlp from following an artist channel
   // result and treating its uploads as the search result set.
   //
-  // When YTM returns an artist channel as the top hit, yt-dlp prints the channel's
-  // browse URL (/browse/UC…) instead of video URLs. We detect this on stdout and
-  // return [] so the caller falls through to the ytsearch fallback.
   // NOTE: do NOT check for [youtube:tab] in stderr — that fires for all YTM search
   // page processing, not just channel expansion, and would wrongly return [] always.
   const getYtmVideoUrls = (maxItems) => new Promise(resolve => {
-    const urls = [];
+    let out = '';
-    let channelExpanded = false;
     const proc = spawn(CONFIG.ytdlpBin, [
       ytmUrl,
       '--flat-playlist',
@@ -221,21 +268,13 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
       // native Songs shelf (where the actual artist track lives).
       '--extractor-args', 'youtube:player_client=web_music,default',
     ], { env: { ...process.env, PYTHONUNBUFFERED: '1' } });
-    proc.stdout.on('data', d => {
+    proc.stdout.on('data', d => { out += d.toString(); });
-      const text = d.toString();
-      if (text.includes('/browse/UC')) { channelExpanded = true; return; }
-      if (!channelExpanded) {
-        text.split('\n').forEach(line => {
-          const u = line.trim();
-          if (u.includes('watch?v=')) urls.push(u);
-        });
-      }
-    });
     proc.on('error', () => resolve([]));
     proc.on('close', () => {
-      if (channelExpanded) log(jobId, `⚠️  YTM: Artist-Channel in Suchergebnissen — überspringe`);
+      const { urls, skipped } = pickYtmVideoUrls(out);
-      else log(jobId, `📡 YTM: ${urls.length} Ergebnis(se) gefunden`);
+      if (!urls.length) log(jobId, `⚠️  YTM: keine Song-Treffer (${skipped} Listeneintrag/-eintraege)`);
-      resolve(channelExpanded ? [] : urls);
+      else log(jobId, `📡 YTM: ${urls.length} Ergebnis(se) gefunden${skipped ? ` (${skipped} Album/Kanal uebersprungen)` : ''}`);
+      resolve(urls);
     });
   });
 
@@ -424,4 +463,4 @@ async function embedMetadata({ jobId, audioFile, dir, trackPrefix, safeTitle, ra
   return { success: true, dir };
 }
 
-module.exports = { downloadTrack, embedMetadata };
+module.exports = { downloadTrack, embedMetadata, buildTitleKeywords, buildVariantFilter, pickYtmVideoUrls };

backend/novasonic-server.js

@@ -503,6 +503,19 @@ function _giteaApiJson(pathAndQuery) {
   });
 }
 
+// Gitea baut seine browser_download_url aus der eigenen ROOT_URL — die kann eine ganz andere Adresse
+// sein als die, unter der das Backend Gitea erreicht (interne IP vs. Reverse-Proxy-Domain). Deshalb
+// Schema+Host+Port immer durch GITEA_URL ersetzen und nur den Pfad übernehmen.
+function _viaGiteaHost(urlStr) {
+  if (!urlStr || !GITEA_URL) return urlStr;
+  try {
+    const base = new URL(GITEA_URL);
+    const u = new URL(urlStr);
+    if (u.origin === base.origin) return urlStr;
+    return new URL(u.pathname + u.search, base).toString();
+  } catch { return urlStr; }
+}
+
 // The .apk asset of the fixed release, or null if unavailable.
 async function _giteaApkAsset() {
   const rel = await _giteaApiJson(`/releases/tags/${encodeURIComponent(GITEA_APK_TAG)}`);
@@ -513,7 +526,7 @@ async function _giteaApkAsset() {
   const vcMatch = /versionCode\s*[=:]\s*(\d+)/i.exec(rel.body || '');
   return {
     size: asset.size,
-    url: asset.browser_download_url,
+    url: _viaGiteaHost(asset.browser_download_url),
     version: rel.name || rel.tag_name || null,
     versionCode: vcMatch ? parseInt(vcMatch[1], 10) : null,
     updatedAt: new Date(asset.created_at || rel.published_at || Date.now()).getTime(),
@@ -523,7 +536,13 @@ async function _giteaApkAsset() {
 function _serveLocalApk(res) {
   if (res.headersSent) return;
   fs.stat(APK_PATH, (err) => {
-    if (err) return res.status(404).json({ error: 'Keine APK hinterlegt' });
+    // Ohne lokale Datei UND ohne erreichbares Gitea-Asset: sagen, welcher der beiden Wege fehlt,
+    // sonst sucht man die APK an der falschen Stelle (die Logs oben nennen den Grund).
+    if (err) return res.status(404).json({
+      error: (GITEA_URL && GITEA_REPO)
+        ? `APK-Release nicht erreichbar (${GITEA_URL}, Tag ${GITEA_APK_TAG}) und keine lokale Datei unter ${APK_PATH}`
+        : 'Keine APK hinterlegt',
+    });
     res.setHeader('Content-Type', 'application/vnd.android.package-archive');
     res.setHeader('Content-Disposition', 'attachment; filename="NovaSonic.apk"');
     res.sendFile(APK_PATH);
@@ -539,14 +558,21 @@ function _streamApkFromUrl(urlStr, res, redirectsLeft = 3) {
   lib.get(u, { headers }, up => {
     if ([301, 302, 303, 307, 308].includes(up.statusCode) && up.headers.location && redirectsLeft > 0) {
       up.resume();
-      return _streamApkFromUrl(new URL(up.headers.location, u).toString(), res, redirectsLeft - 1);
+      return _streamApkFromUrl(_viaGiteaHost(new URL(up.headers.location, u).toString()), res, redirectsLeft - 1);
+    }
+    if (up.statusCode !== 200) {
+      up.resume();
+      console.warn(`[apk] Gitea-Asset lieferte HTTP ${up.statusCode} (${u.origin}) — fallback auf ${APK_PATH}`);
+      return _serveLocalApk(res);
     }
-    if (up.statusCode !== 200) { up.resume(); return _serveLocalApk(res); }
     res.setHeader('Content-Type', 'application/vnd.android.package-archive');
     res.setHeader('Content-Disposition', 'attachment; filename="NovaSonic.apk"');
     if (up.headers['content-length']) res.setHeader('Content-Length', up.headers['content-length']);
     up.pipe(res);
-  }).on('error', () => _serveLocalApk(res));
+  }).on('error', (e) => {
+    console.warn(`[apk] Gitea-Asset nicht erreichbar (${u.origin}): ${e.message} — fallback auf ${APK_PATH}`);
+    _serveLocalApk(res);
+  });
 }
 
 app.get('/api/apk/info', async (req, res) => {
@@ -1316,6 +1342,19 @@ async function _migratePlaylists(ndUrl, user, pass, plIds, oldId, newId) {
 }
 
 // ─── METADATA EDIT ───────────────────────────────────────────────────────────
+// Liest die vorhandenen Tags einer Datei. Wird gebraucht, um einen ueber Namensaehnlichkeit
+// gefundenen Kandidaten zu PRUEFEN, bevor er ueberschrieben wird.
+async function _readTags(file) {
+  return new Promise((resolve) => {
+    const proc = spawn('ffprobe', ['-v', 'quiet', '-print_format', 'json', '-show_entries', 'format_tags', file]);
+    let buf = '';
+    proc.stdout.on('data', d => buf += d);
+    proc.on('error', () => resolve({}));
+    proc.on('close', () => { try { resolve(JSON.parse(buf)?.format?.tags || {}); } catch { resolve({}); } });
+  });
+}
+const _tagNorm = (v) => (v || '').toLowerCase().replace(/[^\p{L}\p{N}]+/gu, '');
+
 app.post('/api/edit-metadata', async (req, res) => {
   const { ndUrl, user, pass, songId, title, artist, albumArtist, album, year, trackNum, totalTracks,
           discNum, discTotal, genre, artworkBase64, artworkMime, artworkUrl: newArtworkUrl,
@@ -1375,8 +1414,32 @@ app.post('/api/edit-metadata', async (req, res) => {
       // can be "[Unknown Album]" while the file actually sits in "Singles" with an artist
       // prefix. findExistingTrack matches by normalized artist+title across all album folders.
       || findExistingTrack(CONFIG.musicPath, ndSong.albumArtist || ndSong.artist || '', ndSong.title || '');
-    if (found) { filePath = found; }
+    if (!found) {
-    else return res.status(404).json({ error: `File not found: ${filePath} (music root: ${CONFIG.musicPath})` });
+      return res.status(404).json({ error: `File not found: ${filePath} (music root: ${CONFIG.musicPath})` });
+    }
+    // Der Treffer stammt aus einer Aehnlichkeitssuche ueber Dateiname bzw. Kuenstler+Titel. Liegt
+    // derselbe Song mehrfach auf der Platte — etwa ein Fehlgriff des Downloaders neben der richtigen
+    // Datei —, kann das die FALSCHE Kopie sein. Die wurde dann getaggt, waehrend der bearbeitete Song
+    // unveraendert blieb: die Aenderung "sprang zurueck". Deshalb wird der Kandidat gegen die Tags
+    // geprueft, die Navidrome fuer diesen Song meldet, und im Zweifel abgebrochen statt geraten.
+    const kandidatTags = await _readTags(found);
+    const istTitel  = _tagNorm(kandidatTags.title  || kandidatTags.TITLE);
+    const istArtist = _tagNorm(kandidatTags.artist || kandidatTags.ARTIST);
+    const sollTitel  = _tagNorm(ndSong?.title);
+    const sollArtist = _tagNorm(ndSong?.artist);
+    const titelPasst  = !sollTitel  || !istTitel  || istTitel === sollTitel;
+    const artistPasst = !sollArtist || !istArtist ||
+                        istArtist.includes(sollArtist) || sollArtist.includes(istArtist);
+    if (!titelPasst || !artistPasst) {
+      return res.status(409).json({
+        error: `Datei nicht eindeutig zuzuordnen. Navidrome meldet "${ndSong?.artist || '?'} – ` +
+               `${ndSong?.title || '?'}", die gefundene Datei enthaelt aber "` +
+               `${kandidatTags.artist || '?'} – ${kandidatTags.title || '?'}" (${found}). ` +
+               `Vermutlich liegt derselbe Song mehrfach in der Bibliothek — bitte die Dubletten ` +
+               `aufraeumen, sonst wuerde die falsche Datei bearbeitet.`,
+      });
+    }
+    filePath = found;
   }
 
   // Resolve artwork: base64 > URL
@@ -1455,6 +1518,10 @@ app.post('/api/edit-metadata', async (req, res) => {
 
     // ── Post-save: rename file and/or move to correct artist/album folder ──
     let currentFile = filePath;
+    // Umbenennen und Verschieben werden uebersprungen, wenn am Ziel schon eine Datei liegt. Das war
+    // bisher stumm — der Song blieb dann unter dem alten Namen bzw. im alten Ordner liegen, ohne dass
+    // es jemand erfuhr. Solche Faelle kommen jetzt als Warnung mit in die Antwort.
+    const warnungen = [];
 
     // 1. Rename file if title changed — convention: {01 - }?{Artist} - {Title}.ext
     // Use original names (may be Japanese); romaji goes only into sort tags.
@@ -1465,9 +1532,15 @@ app.post('/api/edit-metadata', async (req, res) => {
       const prefix         = trackNum ? String(trackNum).padStart(2, '0') + ' - ' : '';
       const newName        = `${prefix}${safeArtistPart}${safeTitle}${fileExt}`;
       const newPath        = path.join(path.dirname(currentFile), newName);
-      if (newPath !== currentFile && !fs.existsSync(newPath)) {
+      if (newPath !== currentFile && fs.existsSync(newPath)) {
+        warnungen.push(`Datei nicht umbenannt: "${path.basename(newPath)}" existiert bereits im ` +
+                       `selben Ordner. Die Tags wurden geschrieben, der Dateiname bleibt alt.`);
+      } else if (newPath !== currentFile) {
         try { fs.renameSync(currentFile, newPath); currentFile = newPath; }
-        catch (e) { console.error('[edit-metadata] file rename:', e.message); }
+        catch (e) {
+          console.error('[edit-metadata] file rename:', e.message);
+          warnungen.push(`Umbenennen fehlgeschlagen: ${e.message}`);
+        }
       }
     }
 
@@ -1482,7 +1555,10 @@ app.post('/api/edit-metadata', async (req, res) => {
       try {
         fs.mkdirSync(newDir, { recursive: true });
         const destFile = path.join(newDir, path.basename(currentFile));
-        if (!fs.existsSync(destFile)) {
+        if (fs.existsSync(destFile)) {
+          warnungen.push(`Nicht verschoben: "${destFile}" existiert bereits. Die Datei bleibt in ` +
+                         `"${oldAlbumDir}" — vermutlich eine Dublette.`);
+        } else {
           fs.renameSync(currentFile, destFile);
           currentFile = destFile;
         }
@@ -1522,7 +1598,9 @@ app.post('/api/edit-metadata', async (req, res) => {
       }
     }
 
-    res.json({ ok: true });
+    // Den tatsaechlich bearbeiteten Pfad mitgeben: wer eine Aenderung "zurueckspringen" sieht, kann
+    // damit sofort erkennen, ob die richtige Datei erwischt wurde.
+    res.json({ ok: true, file: currentFile, warnings: warnungen });
   } catch (e) {
     try { if (fs.existsSync(tmpFile)) fs.unlinkSync(tmpFile); } catch {}
     if (artFile) try { fs.unlinkSync(artFile); } catch {}

backend/test/ytdlp.test.js

@@ -0,0 +1,109 @@
+const test = require('node:test');
+const assert = require('node:assert');
+const { buildTitleKeywords } = require('../lib/ytdlp.js');
+
+// The keywords become `title ~= (?i)<kw>` match-filters in yt-dlp, i.e. every keyword must match
+// the candidate title case-insensitively. This mirrors that check.
+const accepts = (title, candidate) =>
+  buildTitleKeywords(title).every(kw => new RegExp(kw, 'i').test(candidate));
+
+test('a number in the title is always required, however short', () => {
+  const kws = buildTitleKeywords('700 Main Street');
+  assert.ok(kws.some(k => k.includes('700')), `700 fehlt in ${JSON.stringify(kws)}`);
+});
+
+test('rejects a same-shaped title with a different number', () => {
+  // The real regression: "777 Main Street" (Release - Topic) was downloaded for DAT ADAM's
+  // "700 Main Street", because only the two longest words (Street, Main) were required.
+  assert.equal(accepts('700 Main Street', '777 Main Street'), false);
+  assert.equal(accepts('700 Main Street', '700 Main Street'), true);
+});
+
+test('accepts the abbreviated spelling uploaders use', () => {
+  assert.equal(accepts('700 Main Street', '700 Main st (cr-Version)'), true);
+  assert.equal(accepts('700 Main Street', 'DAT ADAM - 700 Main St [FULL SONG]'), true);
+});
+
+test('the abbreviation does not match inside another word', () => {
+  assert.equal(accepts('700 Main Street', '700 Main Stuff'), false);
+});
+
+test('titles without numbers keep the previous two-longest-words behaviour', () => {
+  assert.deepEqual(buildTitleKeywords('Bohemian Rhapsody'), ['Bohemian', 'Rhapsody']);
+  assert.equal(accepts('Bohemian Rhapsody', 'Queen - Bohemian Rhapsody (Official Video)'), true);
+  assert.equal(accepts('Bohemian Rhapsody', 'Queen - Another One Bites The Dust'), false);
+});
+
+test('a remaster year is not required — YouTube titles never carry it', () => {
+  // "… - 2020 Remaster" steht auf der Veröffentlichung, der Upload heißt schlicht
+  // "Take Me Home, Country Roads". Vor dieser Ausnahme hätte die 2020 ihn abgelehnt.
+  assert.equal(accepts('Take Me Home, Country Roads - 2020 Remaster',
+                       'John Denver - Take Me Home, Country Roads'), true);
+});
+
+test('a year that IS the title stays required', () => {
+  assert.equal(accepts('1999', 'Prince - 1999 (Official Music Video)'), true);
+  assert.equal(accepts('1999', 'Prince - 1984 (Official Music Video)'), false);
+});
+
+const { buildVariantFilter } = require('../lib/ytdlp.js');
+
+// Der Variantenfilter ist eine yt-dlp-Ausdruckskette "title !~= (?i)\bx\b & …".
+// Diese Hilfsfunktion wertet sie so aus, wie yt-dlp es tut.
+const variantAccepts = (searchTitle, candidate) => {
+  const f = buildVariantFilter(searchTitle);
+  if (!f) return true;
+  return f.split(' & ').every(part => {
+    const m = /^title !~= \(\?i\)(.+)$/.exec(part);
+    return !new RegExp(m[1], 'i').test(candidate);
+  });
+};
+
+test('rejects a live recording — is_live only covers running streams', () => {
+  // Der echte Fall: auf dem Kuenstlerkanal, Dauer im Fenster, Titel passend.
+  assert.equal(variantAccepts('UFO', 'Dat Adam - Ufo Video Days 2015 Live'), false);
+  assert.equal(variantAccepts('UFO', 'DAT ADAM - 700 Main St | ROCK AM RING 2017 [LIVE]'), false);
+  assert.equal(variantAccepts('UFO', 'UFO'), true);
+});
+
+test('a deliberately live title keeps its live results', () => {
+  assert.equal(variantAccepts('Live Forever', 'Oasis - Live Forever'), true);
+  assert.equal(variantAccepts('Unplugged in New York (Live)', 'Nirvana - All Apologies (Live)'), true);
+});
+
+test('"live" inside another word does not disable the rule', () => {
+  // "deliver" enthaelt "live" als Teilstring — die Regel muss trotzdem greifen.
+  assert.equal(variantAccepts('Deliver', 'Artist - Deliver (Live at Wembley)'), false);
+  assert.equal(variantAccepts('Deliver', 'Artist - Deliver'), true);
+});
+
+const { pickYtmVideoUrls } = require('../lib/ytdlp.js');
+
+// Echte Ausgabe der YTM-Suche "DAT ADAM UFO": Songs, ein Album (MPREb_) und der
+// Kuenstlerkanal (UC…) auf Platz 9.
+const YTM_OUT = [
+  'https://music.youtube.com/watch?v=ZG4XhPn3Yb4',
+  'https://music.youtube.com/watch?v=2KVU6aikZF0',
+  'https://music.youtube.com/browse/MPREb_IhxJPixC1QT',
+  'https://music.youtube.com/watch?v=phLOTtJaqZk',
+  'https://music.youtube.com/watch?v=p935nH6aj8Y',
+  'https://music.youtube.com/watch?v=Pb2YcDBm5fA',
+  'https://music.youtube.com/browse/MPREb_S7MMKVMduma',
+  'https://music.youtube.com/watch?v=mNfsX2RbZ2M',
+  'https://music.youtube.com/browse/UC5hilNPCUHEPf4VpG5_YpYA',
+  'https://music.youtube.com/watch?v=O034JUlf1J4',
+].join('\n');
+
+test('a channel hit no longer discards the whole result list', () => {
+  const { urls, skipped } = pickYtmVideoUrls(YTM_OUT);
+  assert.equal(urls.length, 7);
+  assert.equal(skipped, 3);                                  // 2 Alben + 1 Kanal
+  assert.match(urls[0], /ZG4XhPn3Yb4/);                      // der offizielle Art Track
+  assert.ok(!urls.some(u => u.includes('/browse/')));
+});
+
+test('nothing but list entries yields no candidates', () => {
+  const only = 'https://music.youtube.com/browse/UC5hilNPCUHEPf4VpG5_YpYA';
+  assert.deepEqual(pickYtmVideoUrls(only).urls, []);
+  assert.deepEqual(pickYtmVideoUrls('').urls, []);
+});

docker-compose.dev.yml

@@ -0,0 +1,67 @@
+# NovaSonic — DEV/Selbstbauen: baut lokal aus den Dockerfiles statt Images zu ziehen. Die schweren
+# Deps (ffmpeg, Deno, yt-dlp, node libs) stecken in den Images, also sind RESTARTS sofort da und ein
+# Rebuild nach Code-Änderungen ist schnell (Docker cacht die Dep-Layer — nur der COPY-Layer ändert sich).
+#
+#   git pull
+#   docker compose -f docker-compose.dev.yml up -d --build   # geänderte Images neu bauen + starten
+#   docker compose -f docker-compose.dev.yml up -d           # nur starten, mit den gebauten Images
+#
+# Keine Registry nötig. Der Normalfall (fertige Images ziehen) ist docker-compose.yml.
+services:
+
+  # ── Frontend (nginx serving the built PWA) ───────────────────────────────────
+  novasonic-frontend:
+    build: .
+    container_name: novasonic-frontend
+    restart: unless-stopped
+    ports:
+      - "8080:80"          # route this port through your reverse proxy
+    environment:
+      - NAVIDROME_URL=${NAVIDROME_URL}   # pre-filled on the setup screen
+      - BACKEND_URL=${BACKEND_URL}
+      - SCROBBLE_URL=${SCROBBLE_URL}
+
+  # ── Backend (yt-dlp download server) ─────────────────────────────────────────
+  novasonic-backend:
+    build:
+      context: ./backend
+    container_name: novasonic-backend
+    restart: unless-stopped
+    volumes:
+      - ${MUSIC_PATH}:${MUSIC_PATH}      # exact path from .env, no remapping
+      - novasonic-data:/data             # writable data dir for overrides, state, etc.
+    ports:
+      - "3700:3700"
+    environment:
+      - PORT=3700
+      - MUSIC_PATH=${MUSIC_PATH}
+      - DATA_PATH=/data
+      - AUDIO_FMT=${AUDIO_FMT:-mp3}
+      - AUDIO_QUALITY=${AUDIO_QUALITY:-0}
+      - MAX_PARALLEL=${MAX_PARALLEL:-2}
+      - DOWNLOAD_BACKEND=${DOWNLOAD_BACKEND:-ytdlp}
+      - TICKETMASTER_API_KEY=${TICKETMASTER_API_KEY}
+      # Android APK download button — backend proxies the fixed Gitea release ("apk-latest").
+      - GITEA_URL=${GITEA_URL:-}
+      - GITEA_REPO=${GITEA_REPO:-}
+      - GITEA_TOKEN=${GITEA_TOKEN:-}
+      - GITEA_APK_TAG=${GITEA_APK_TAG:-apk-latest}
+
+  # ── Scrobble service (isolated timestamped play-log → stats + Wrapped) ────────
+  novasonic-scrobble:
+    build:
+      context: ./scrobble
+    container_name: novasonic-scrobble
+    restart: unless-stopped
+    volumes:
+      - novasonic-scrobble-data:/data    # own DB volume, isolated from downloads
+    ports:
+      - "3710:3710"
+    environment:
+      - PORT=3710
+      - DATA_PATH=/data
+      - NAVIDROME_URL=${NAVIDROME_URL}   # for ping.view auth verification
+
+volumes:
+  novasonic-data:
+  novasonic-scrobble-data:

docker-compose.yml

@@ -1,75 +1,64 @@
+# NovaSonic — Standard/Produktiv: zieht die fertigen Images aus der Registry, baut nichts.
+# Auf dem Server nur .env danebenlegen (siehe .env.example) und:
+#
+#   docker compose pull
+#   docker compose up -d
+#
+# Die Images kommen von der Dev-Maschine: `npm run push-images` (baut die drei Dockerfiles und
+# pusht nach ${REGISTRY}). Selbst bauen statt ziehen: docker-compose.dev.yml.
 services:
 
-  # ── Frontend (nginx) ──────────────────────────────────────────────────────────
+  # ── Frontend (nginx serving the built PWA) ───────────────────────────────────
   novasonic-frontend:
-    build: .
+    image: ${REGISTRY}/novasonic-frontend:${TAG:-latest}
     container_name: novasonic-frontend
     restart: unless-stopped
     ports:
       - "8080:80"          # route this port through your reverse proxy
     environment:
       - NAVIDROME_URL=${NAVIDROME_URL}   # pre-filled on the setup screen
-      - BACKEND_URL=${BACKEND_URL}       # pre-filled on the setup screen
+      - BACKEND_URL=${BACKEND_URL}
-      - SCROBBLE_URL=${SCROBBLE_URL}     # play-log / stats service (setup screen)
+      - SCROBBLE_URL=${SCROBBLE_URL}
 
   # ── Backend (yt-dlp download server) ─────────────────────────────────────────
   novasonic-backend:
-    image: node:22-slim
+    image: ${REGISTRY}/novasonic-backend:${TAG:-latest}
     container_name: novasonic-backend
     restart: unless-stopped
-    working_dir: /app
     volumes:
-      - ./backend:/app:ro                # mount entire backend dir (server + lib/)
       - ${MUSIC_PATH}:${MUSIC_PATH}      # exact path from .env, no remapping
       - novasonic-data:/data             # writable data dir for overrides, state, etc.
     ports:
-      - "3700:3700"                      # route this port through your reverse proxy
+      - "3700:3700"
     environment:
       - PORT=3700
-      - MUSIC_PATH=${MUSIC_PATH}         # same path inside the container
+      - MUSIC_PATH=${MUSIC_PATH}
       - DATA_PATH=/data
       - AUDIO_FMT=${AUDIO_FMT:-mp3}
       - AUDIO_QUALITY=${AUDIO_QUALITY:-0}
       - MAX_PARALLEL=${MAX_PARALLEL:-2}
       - DOWNLOAD_BACKEND=${DOWNLOAD_BACKEND:-ytdlp}
       - TICKETMASTER_API_KEY=${TICKETMASTER_API_KEY}
-      # Android APK download button — backend proxies a fixed Gitea release ("apk-latest"), same LAN.
+      # Android APK download button — backend proxies the fixed Gitea release ("apk-latest").
-      # Optional: leave unset to use the local /data/novasonic.apk fallback instead.
+      - GITEA_URL=${GITEA_URL:-}
-      - GITEA_URL=${GITEA_URL:-}                 # internal Gitea base, e.g. http://gitea:3000
+      - GITEA_REPO=${GITEA_REPO:-}
-      - GITEA_REPO=${GITEA_REPO:-}               # owner/repo, e.g. Docker/NovaSonic
+      - GITEA_TOKEN=${GITEA_TOKEN:-}
-      - GITEA_TOKEN=${GITEA_TOKEN:-}             # read token (only for a private repo)
       - GITEA_APK_TAG=${GITEA_APK_TAG:-apk-latest}
-    command: >
-      sh -c "
-        apt-get update && apt-get install -y --no-install-recommends python3 python3-pip ffmpeg curl git unzip && rm -rf /var/lib/apt/lists/* &&
-        pip install --break-system-packages -U --pre 'yt-dlp[default]' &&
-        curl -fsSL https://deno.land/install.sh | sh &&
-        pip install --break-system-packages spotapi 'git+https://github.com/TzurSoffer/spotify-downloader' &&
-        mkdir -p /deps && cd /deps && npm install express kuromoji &&
-        cd /app && PATH=/root/.deno/bin:$$PATH NODE_PATH=/deps/node_modules node novasonic-server.js
-      "
 
-  # ── Scrobble service (isolated timestamped play-log → stats + Wrapped) ────────
+  # ── Scrobble service (isolated timestamped play-log → stats + Wrapped) ───────
   novasonic-scrobble:
-    image: node:22-slim
+    image: ${REGISTRY}/novasonic-scrobble:${TAG:-latest}
     container_name: novasonic-scrobble
     restart: unless-stopped
-    working_dir: /app
     volumes:
-      - ./scrobble:/app:ro               # server code (read-only)
       - novasonic-scrobble-data:/data    # own DB volume, isolated from downloads
     ports:
-      - "3710:3710"                      # route this port through your reverse proxy
+      - "3710:3710"
     environment:
       - PORT=3710
       - DATA_PATH=/data
       - NAVIDROME_URL=${NAVIDROME_URL}   # for ping.view auth verification
-    command: >
-      sh -c "
-        mkdir -p /deps && cd /deps && npm install express &&
-        cd /app && NODE_PATH=/deps/node_modules node --experimental-sqlite scrobble-server.js
-      "
 
 volumes:
-  novasonic-data:          # persistent storage for romaji overrides and app state
+  novasonic-data:
-  novasonic-scrobble-data: # persistent play-log DB (novasonic-plays.db)
+  novasonic-scrobble-data:

index.html

@@ -605,18 +605,6 @@
           <div id="s-cover-color-bg" class="toggle" onclick="this.classList.toggle('on')"></div>
         </div>
       </div>
-      <div class="settings-section" id="s-apk-section" style="display:none">
-        <h3 style="display:flex;align-items:center;gap:8px;margin-bottom:12px">
-          <span style="width:24px;height:24px;border-radius:6px;background:var(--surface2);display:inline-flex;align-items:center;justify-content:center;font-size:12px">🤖</span>
-          Android App
-        </h3>
-        <div style="font-size:12px;color:var(--text2);margin-bottom:10px;line-height:1.6">Installiere die NovaSonic Android-App direkt aufs Handy. <span id="s-apk-meta" style="color:var(--text3)"></span></div>
-        <a id="s-apk-btn" href="#" download style="display:inline-flex;align-items:center;gap:8px;padding:10px 16px;border-radius:10px;background:linear-gradient(135deg,var(--accent),var(--accent-dark));color:#fff;font-weight:700;font-size:13px;text-decoration:none;box-shadow:0 4px 12px var(--accent-glow)">
-          <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
-          APK herunterladen
-        </a>
-        <div style="font-size:11px;color:var(--text3);margin-top:8px">Danach im Handy „Installation aus unbekannten Quellen" für den Browser erlauben.</div>
-      </div>
       <div class="settings-section">
         <h3 style="display:flex;align-items:center;gap:8px;margin-bottom:12px">
           <span style="width:24px;height:24px;border-radius:6px;background:var(--surface2);display:inline-flex;align-items:center;justify-content:center;font-size:12px">📊</span>
@@ -709,6 +697,18 @@
         <div class="field"><label>Benutzername</label><input id="s-user" type="text" placeholder="admin"></div>
         <div class="field"><label>Passwort</label><input id="s-pass" type="password" placeholder="(unverändert lassen)"></div>
       </div>
+      <div class="settings-section" id="s-apk-section" style="display:none">
+        <h3 style="display:flex;align-items:center;gap:8px;margin-bottom:12px">
+          <span style="width:24px;height:24px;border-radius:6px;background:var(--surface2);display:inline-flex;align-items:center;justify-content:center;font-size:12px">🤖</span>
+          Android App
+        </h3>
+        <div style="font-size:12px;color:var(--text2);margin-bottom:10px;line-height:1.6">Installiere die NovaSonic Android-App direkt aufs Handy. <span id="s-apk-meta" style="color:var(--text3)"></span></div>
+        <a id="s-apk-btn" href="#" download style="display:inline-flex;align-items:center;gap:8px;padding:10px 16px;border-radius:10px;background:linear-gradient(135deg,var(--accent),var(--accent-dark));color:#fff;font-weight:700;font-size:13px;text-decoration:none;box-shadow:0 4px 12px var(--accent-glow)">
+          <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
+          APK herunterladen
+        </a>
+        <div style="font-size:11px;color:var(--text3);margin-top:8px">Danach im Handy „Installation aus unbekannten Quellen" für den Browser erlauben.</div>
+      </div>
     </div>
     <!-- Sticky footer -->
     <div style="display:flex;flex-direction:column;gap:8px;padding:12px 24px 16px;border-top:1px solid var(--border);flex-shrink:0;background:var(--surface);border-radius:0 0 18px 18px">

package.json

@@ -6,7 +6,8 @@
     "build": "vite build",
     "preview": "vite preview",
     "icons": "node scripts/gen-icons.mjs",
-    "publish-apk": "node scripts/publish-apk.mjs"
+    "publish-apk": "node scripts/publish-apk.mjs",
+    "push-images": "node scripts/build-push-images.mjs"
   },
   "devDependencies": {
     "sharp": "^0.34.5",

scripts/build-push-images.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+// Build the three NovaSonic images and push them to your registry, so the production host just PULLS
+// (docker-compose.yml) instead of building (that's docker-compose.dev.yml). Run from your dev machine:
+//
+//   npm run push-images                 # builds + pushes REGISTRY/*:TAG (and :latest)
+//
+// Config (env or a gitignored scripts/.env.release / repo .env):
+//   REGISTRY   e.g. gitea.honeyy.duckdns.org/docker   (Gitea uses a LOWERCASE owner)
+//   TAG        image tag (default: latest)
+// You must `docker login <registry-host>` once first. Plain-HTTP internal registries also need the
+// daemon's insecure-registries list (see .env.example).
+
+import { spawnSync } from 'node:child_process';
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join, resolve } from 'node:path';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+// Load REGISTRY/TAG from a local env file if present (repo .env, then scripts/.env.release).
+for (const f of [join(root, '.env'), join(root, 'scripts', '.env.release')]) {
+  if (!existsSync(f)) continue;
+  for (const line of readFileSync(f, 'utf8').split('\n')) {
+    const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.*)\s*$/i);
+    if (m && !(m[1] in process.env)) process.env[m[1]] = m[2].replace(/^["']|["']$/g, '');
+  }
+}
+
+const REGISTRY = (process.env.REGISTRY || '').replace(/\/$/, '');
+const TAG      = process.env.TAG || 'latest';
+if (!REGISTRY) { console.error('\n✖ REGISTRY muss gesetzt sein (env oder .env). Siehe .env.example.'); process.exit(1); }
+
+// name → build context (relative to repo root). Frontend uses the root Dockerfile.
+const images = {
+  'novasonic-frontend': '.',
+  'novasonic-backend':  'backend',
+  'novasonic-scrobble': 'scrobble',
+};
+
+function run(cmd, args) {
+  console.log(`\n$ ${cmd} ${args.join(' ')}`);
+  const r = spawnSync(cmd, args, { cwd: root, stdio: 'inherit', shell: process.platform === 'win32' });
+  if (r.status !== 0) { console.error(`\n✖ Fehlgeschlagen: ${cmd} ${args.join(' ')}`); process.exit(1); }
+}
+
+for (const [name, ctx] of Object.entries(images)) {
+  const ref    = `${REGISTRY}/${name}:${TAG}`;
+  const latest = `${REGISTRY}/${name}:latest`;
+  console.log(`\n=== ${name} → ${ref} ===`);
+  run('docker', ['build', '-t', ref, '-t', latest, ctx]);
+  run('docker', ['push', ref]);
+  if (latest !== ref) run('docker', ['push', latest]);
+}
+
+console.log(`\n✔ Alle Images gebaut + gepusht (${REGISTRY}/*:${TAG}). Auf dem Server:`);
+console.log('   docker compose pull && docker compose up -d');

scrobble/Dockerfile

@@ -0,0 +1,15 @@
+# NovaSonic scrobble service — isolated timestamped play-log. Uses Node's built-in SQLite
+# (--experimental-sqlite), so the only dependency is express. Build context = ./scrobble.
+FROM node:22-slim
+
+WORKDIR /deps
+RUN npm install express
+ENV NODE_PATH=/deps/node_modules
+
+WORKDIR /app
+COPY . /app/
+
+ENV PORT=3710 DATA_PATH=/data
+EXPOSE 3710
+
+CMD ["node","--experimental-sqlite","scrobble-server.js"]

scrobble/package-lock.json

@@ -0,0 +1,829 @@
+{
+  "name": "novasonic-scrobble",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "novasonic-scrobble",
+      "dependencies": {
+        "express": "^4.22.2"
+      },
+      "engines": {
+        "node": ">=22"
+      }
+    },
+    "node_modules/accepts": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
+      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-types": "~2.1.34",
+        "negotiator": "0.6.3"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/array-flatten": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
+      "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
+      "license": "MIT"
+    },
+    "node_modules/body-parser": {
+      "version": "1.20.6",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz",
+      "integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "content-type": "~1.0.5",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "~1.2.0",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "on-finished": "~2.4.1",
+        "qs": "~6.15.1",
+        "raw-body": "~2.5.3",
+        "type-is": "~1.6.18",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "get-intrinsic": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/content-disposition": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "5.2.1"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/content-type": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
+      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie-signature": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.7.tgz",
+      "integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==",
+      "license": "MIT"
+    },
+    "node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/destroy": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
+      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "license": "MIT"
+    },
+    "node_modules/encodeurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "license": "MIT"
+    },
+    "node_modules/etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/express": {
+      "version": "4.22.2",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
+      "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
+      "license": "MIT",
+      "dependencies": {
+        "accepts": "~1.3.8",
+        "array-flatten": "1.1.1",
+        "body-parser": "~1.20.5",
+        "content-disposition": "~0.5.4",
+        "content-type": "~1.0.4",
+        "cookie": "~0.7.1",
+        "cookie-signature": "~1.0.6",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "finalhandler": "~1.3.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.0",
+        "merge-descriptors": "1.0.3",
+        "methods": "~1.1.2",
+        "on-finished": "~2.4.1",
+        "parseurl": "~1.3.3",
+        "path-to-regexp": "~0.1.12",
+        "proxy-addr": "~2.0.7",
+        "qs": "~6.15.1",
+        "range-parser": "~1.2.1",
+        "safe-buffer": "5.2.1",
+        "send": "~0.19.0",
+        "serve-static": "~1.16.2",
+        "setprototypeof": "1.2.0",
+        "statuses": "~2.0.1",
+        "type-is": "~1.6.18",
+        "utils-merge": "1.0.1",
+        "vary": "~1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/finalhandler": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
+      "integrity": "sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "2.6.9",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "on-finished": "~2.4.1",
+        "parseurl": "~1.3.3",
+        "statuses": "~2.0.2",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fresh": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.4.24",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/media-typer": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/merge-descriptors": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
+      "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/methods": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
+      "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
+      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
+      "license": "MIT",
+      "bin": {
+        "mime": "cli.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "license": "MIT"
+    },
+    "node_modules/negotiator": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
+      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "license": "MIT",
+      "dependencies": {
+        "ee-first": "1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/path-to-regexp": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
+      "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
+      "license": "MIT"
+    },
+    "node_modules/proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "license": "MIT",
+      "dependencies": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/qs": {
+      "version": "6.15.3",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
+      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/range-parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
+      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/raw-body": {
+      "version": "2.5.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
+      "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT"
+    },
+    "node_modules/send": {
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
+      "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "1.2.0",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.1",
+        "mime": "1.6.0",
+        "ms": "2.1.3",
+        "on-finished": "~2.4.1",
+        "range-parser": "~1.2.1",
+        "statuses": "~2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/send/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/serve-static": {
+      "version": "1.16.3",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz",
+      "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==",
+      "license": "MIT",
+      "dependencies": {
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "parseurl": "~1.3.3",
+        "send": "~0.19.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "license": "ISC"
+    },
+    "node_modules/side-channel": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
+    "node_modules/type-is": {
+      "version": "1.6.18",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
+      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+      "license": "MIT",
+      "dependencies": {
+        "media-typer": "0.3.0",
+        "mime-types": "~2.1.24"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/utils-merge": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
+      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    }
+  }
+}

scrobble/package.json

@@ -2,11 +2,13 @@
   "name": "novasonic-scrobble",
   "private": true,
   "description": "Isolated timestamped play-log service for NovaSonic (stats + Wrapped).",
-  "engines": { "node": ">=22" },
+  "engines": {
+    "node": ">=22"
+  },
   "scripts": {
     "start": "node --experimental-sqlite scrobble-server.js"
   },
   "dependencies": {
-    "express": "^4.18.0"
+    "express": "^4.22.2"
   }
 }

scrobble/scrobble-server.js

@@ -172,6 +172,14 @@ app.get('/scrobble/history', async (req, res) => {
 //   ?tz=         seconds east of UTC for local-day bucketing (default 0)
 //   ?bucket=     day | month | year  — granularity of the time series (default day)
 //   ?limit=      top-list size (default 20, max 100)
+// Gruppierungsschluessel fuer Texte: Klein-/Grossschreibung, Rand-Leerzeichen und mehrfache
+// Leerzeichen duerfen keine zwei Eintraege aus einem machen. Genau das passiert sonst, sobald
+// jemand Metadaten bearbeitet ("Dat Adam" -> "DAT ADAM" waeren zwei Kuenstler in der Statistik).
+// SQLite kennt kein Regex, deshalb wird die Leerzeichen-Faltung zweimal angewandt (deckt bis zu
+// vier aufeinanderfolgende Leerzeichen ab — mehr kommt in Tags praktisch nicht vor).
+const normKey = (col) =>
+  `lower(trim(replace(replace(replace(COALESCE(${col},''), char(9), ' '), '  ', ' '), '  ', ' ')))`;
+
 // Buckets are computed on the fly (GROUP BY strftime) — no rollup tables.
 const _STATS_FMT = { day: '%Y-%m-%d', month: '%Y-%m', year: '%Y' };
 
@@ -202,31 +210,62 @@ app.get('/scrobble/stats', async (req, res) => {
   // navigator so you can't step before logging began.
   const firstPlayedAt = db.prepare('SELECT MIN(played_at) AS t FROM plays WHERE user = :user').get({ user }).t || null;
 
+  // Anzeigename aus dem JUENGSTEN Play, nicht per MAX(): sonst gewinnt lexikografisch die alte
+  // Schreibweise und die Statistik zeigt nach einer Korrektur weiter den alten Namen.
   const topArtists = db.prepare(`
-    SELECT MAX(artist) AS name, MAX(artist_id) AS artistId, COUNT(*) AS plays, COALESCE(SUM(duration),0) AS seconds
+    WITH neueste AS (
-    FROM plays WHERE ${WHERE} AND artist IS NOT NULL AND artist <> ''
+      SELECT ${normKey('artist')} AS k, artist, artist_id, MAX(played_at)
-    GROUP BY lower(artist) ORDER BY plays DESC, seconds DESC LIMIT :limit
+      FROM plays WHERE ${WHERE} AND artist IS NOT NULL AND artist <> '' GROUP BY k
+    ), zaehler AS (
+      SELECT ${normKey('artist')} AS k, COUNT(*) AS plays, COALESCE(SUM(duration),0) AS seconds
+      FROM plays WHERE ${WHERE} AND artist IS NOT NULL AND artist <> '' GROUP BY k
+    )
+    SELECT n.artist AS name, n.artist_id AS artistId, z.plays AS plays, z.seconds AS seconds
+    FROM neueste n JOIN zaehler z ON z.k = n.k
+    ORDER BY z.plays DESC, z.seconds DESC LIMIT :limit
   `).all(winL);
 
   const topAlbums = db.prepare(`
-    SELECT MAX(album) AS name, MAX(album_id) AS albumId, MAX(artist) AS artist,
+    WITH neueste AS (
-           MAX(cover_art) AS coverArt, COUNT(*) AS plays
+      SELECT ${normKey('album')} AS k1, ${normKey('artist')} AS k2,
-    FROM plays WHERE ${WHERE} AND album IS NOT NULL AND album <> ''
+             album, album_id, artist, cover_art, MAX(played_at)
-    GROUP BY lower(album), lower(COALESCE(artist,'')) ORDER BY plays DESC LIMIT :limit
+      FROM plays WHERE ${WHERE} AND album IS NOT NULL AND album <> '' GROUP BY k1, k2
+    ), zaehler AS (
+      SELECT ${normKey('album')} AS k1, ${normKey('artist')} AS k2, COUNT(*) AS plays
+      FROM plays WHERE ${WHERE} AND album IS NOT NULL AND album <> '' GROUP BY k1, k2
+    )
+    SELECT n.album AS name, n.album_id AS albumId, n.artist AS artist,
+           n.cover_art AS coverArt, z.plays AS plays
+    FROM neueste n JOIN zaehler z ON z.k1 = n.k1 AND z.k2 = n.k2
+    ORDER BY z.plays DESC LIMIT :limit
   `).all(winL);
 
+  // Nicht nach song_id gruppieren: wird eine Datei beim Metadaten-Bearbeiten umbenannt, vergibt
+  // Navidrome eine NEUE id — der Titel erschiene dann zweimal mit geteilten Zaehlern. Schluessel ist
+  // deshalb Titel+Kuenstler; Anzeigefelder (inkl. song_id fuer die Navigation) kommen aus dem
+  // JUENGSTEN Play, also mit den frisch bearbeiteten Tags. Das `MAX(played_at)` mit ansonsten
+  // blanken Spalten ist dokumentiertes SQLite-Verhalten: es liefert die Zeile des Maximums.
   const topTracks = db.prepare(`
-    SELECT MAX(title) AS title, MAX(artist) AS artist, MAX(album) AS album,
+    WITH neueste AS (
-           MAX(album_id) AS albumId, MAX(artist_id) AS artistId, MAX(cover_art) AS coverArt,
+      SELECT ${normKey('title')} AS k1, ${normKey('artist')} AS k2,
-           song_id AS songId, COUNT(*) AS plays
+             title, artist, album, album_id, artist_id, cover_art, song_id, MAX(played_at)
       FROM plays WHERE ${WHERE}
-    GROUP BY song_id ORDER BY plays DESC LIMIT :limit
+      GROUP BY k1, k2
+    ), zaehler AS (
+      SELECT ${normKey('title')} AS k1, ${normKey('artist')} AS k2, COUNT(*) AS plays
+      FROM plays WHERE ${WHERE}
+      GROUP BY k1, k2
+    )
+    SELECT n.title AS title, n.artist AS artist, n.album AS album, n.album_id AS albumId,
+           n.artist_id AS artistId, n.cover_art AS coverArt, n.song_id AS songId, z.plays AS plays
+    FROM neueste n JOIN zaehler z ON z.k1 = n.k1 AND z.k2 = n.k2
+    ORDER BY z.plays DESC LIMIT :limit
   `).all(winL);
 
   const topGenres = db.prepare(`
     SELECT MAX(genre) AS name, COUNT(*) AS plays
     FROM plays WHERE ${WHERE} AND genre IS NOT NULL AND genre <> ''
-    GROUP BY lower(genre) ORDER BY plays DESC LIMIT :limit
+    GROUP BY ${normKey('genre')} ORDER BY plays DESC LIMIT :limit
   `).all(winL);
 
   const series = db.prepare(`
@@ -280,14 +319,14 @@ app.get('/scrobble/compare', async (req, res) => {
   const WHERE = 'user = :user AND played_at >= :from AND played_at < :to';
 
   const artistsOf = u => db.prepare(`
-    SELECT lower(artist) AS k, MAX(artist) AS name, MAX(artist_id) AS artistId, COUNT(*) AS plays
+    SELECT ${normKey('artist')} AS k, MAX(artist) AS name, MAX(artist_id) AS artistId, COUNT(*) AS plays
     FROM plays WHERE ${WHERE} AND artist IS NOT NULL AND artist <> ''
-    GROUP BY lower(artist)
+    GROUP BY ${normKey('artist')}
   `).all({ user: u, from, to });
   const tracksOf = u => db.prepare(`
-    SELECT song_id AS songId, MAX(title) AS title, MAX(artist) AS artist, MAX(artist_id) AS artistId,
+    SELECT MAX(song_id) AS songId, MAX(title) AS title, MAX(artist) AS artist, MAX(artist_id) AS artistId,
            MAX(album_id) AS albumId, MAX(cover_art) AS coverArt, COUNT(*) AS plays
-    FROM plays WHERE ${WHERE} GROUP BY song_id
+    FROM plays WHERE ${WHERE} GROUP BY ${normKey('title')}, ${normKey('artist')}
   `).all({ user: u, from, to });
   const totalsOf = u => db.prepare(
     `SELECT COUNT(*) AS plays, COALESCE(SUM(duration),0) AS seconds FROM plays WHERE ${WHERE}`

src/ui/metadata.js

@@ -281,10 +281,18 @@ export async function saveMetadata() {
     });
     const d = await r.json();
     if (!r.ok) throw new Error(d.error || `HTTP ${r.status}`);
-    status.textContent = '✅ Gespeichert! Navidrome scannt…';
-    toast('✅ Metadaten gespeichert');
     invalidateRomajiIndex();
     invalidateApiCache('getArtists');
+    // Warnungen des Backends (Dublette am Zielnamen, nicht verschoben, …) sichtbar machen und das
+    // Fenster offen lassen — sonst sieht es nach "gespeichert" aus, obwohl die Datei liegen blieb.
+    if (d.warnings?.length) {
+      status.innerHTML = '⚠ Gespeichert, aber: ' + d.warnings.map(esc).join('<br>⚠ ') +
+        '<br><span style="color:var(--text3)">Datei: ' + esc(d.file || '?') + '</span>';
+      toast('⚠ Gespeichert — mit Hinweisen, siehe Fenster');
+      return;
+    }
+    status.textContent = '✅ Gespeichert! Navidrome scannt…';
+    toast('✅ Metadaten gespeichert');
     setTimeout(() => { _leaveEditMode(); closeInfoModal(); }, 1500);
   } catch (e) {
     status.textContent = '❌ Fehler: ' + e.message;

src/views/detail.js

@@ -572,8 +572,13 @@ export async function loadPartialAlbumDetail({ nd, deezer }) {
 // ─── ALBUM DETAIL ───
 export async function loadAlbumDetail(album) {
   if (S.cfg.showRomaji) await ensureArtistSortMap().catch(() => {});
+  // Zurück heißt zurück: einen Eintrag im Verlauf zurückgehen, wie auf jeder anderen Detailseite.
+  // Vorher navigierte dieser Knopf VORWÄRTS auf die Albenliste (bzw. den Artist) — das landete nicht
+  // dort, wo man das Album angeklickt hatte, und schob zusätzlich einen neuen History-Eintrag auf den
+  // Stapel, sodass der Browser-Zurück-Knopf sich durch diesen Müll arbeiten musste statt nach Home.
+  // Nur wenn es keinen Verlauf gibt (Direkteinstieg auf ein Album), bleibt die Albenliste das Ziel.
   document.getElementById('album-back-btn').onclick = () =>
-    album._fromArtist ? navigate('artist-detail', album._fromArtist) : navigate('albums');
+    S._navCursor > 0 ? _navGoBack() : navigate('albums');
   document.getElementById('album-detail-name').textContent = dispAlbumName(album);
   const artistEl = document.getElementById('album-detail-artist');
   artistEl.innerHTML = parseArtists(album)

src/views/navigation.js

@@ -59,6 +59,21 @@ export function refreshCurrentView() {
   }
 }
 
+// Gespeicherte Scrollposition wiederherstellen. Ein einzelner requestAnimationFrame reicht dafuer
+// nicht: solange Cover und Listeneintraege noch nachladen, ist scrollHeight kleiner als das Ziel und
+// der Browser kappt den gesetzten Wert stillschweigend — man landete dann doch wieder oben. Deshalb
+// wird der Wert ueber bis zu ~0,5 s erneut gesetzt, bis er sitzt.
+function _restoreScroll(el, y) {
+  if(!el) return;
+  if(!y) { el.scrollTop = 0; return; }
+  let versuche = 0;
+  const setzen = () => {
+    el.scrollTop = y;
+    if(Math.abs(el.scrollTop - y) > 2 && versuche++ < 30) requestAnimationFrame(setzen);
+  };
+  requestAnimationFrame(setzen);
+}
+
 export function navigate(page, data=null) {
   // Scroll + search memory: remember where each history entry was scrolled AND any open local
   // (header) search, so Back/Forward returns you to the same spot with the same query. The global
@@ -86,7 +101,7 @@ export function navigate(page, data=null) {
       // Back/Forward → restore this entry's saved scroll (rAF so the shown page has laid out) and
       // re-open the local (header) search if one was active here.
       const y = S._scrollByIdx[S._navCursor] || 0;
-      if(_main) requestAnimationFrame(() => { _main.scrollTop = y; });
+      if(_main) _restoreScroll(_main, y);
       const hsq = S._hsByIdx[S._navCursor];
       if(hsq && _hsInput) { _hsInput.value = hsq; onHeaderSearch(hsq); }
     } else if(_main) {