feat(web): Library Management — delete an album (files + record)

First Library Management feature. On the Library album modal, "Delete album"
(two-step confirm) removes the album:
- deletes the folder on disk (guarded to only ever remove a path strictly inside
  the library root, LYRA_LIBRARY_ROOT, default /music),
- drops the LibraryItem,
- sets the matching MonitoredRelease monitored=false + currentQualityClass=null
  so the monitor won't immediately re-download it (re-Want later to restore).

Requires the web container to see the library, so docker-compose now bind-mounts
MUSIC_DIR at /music (rw) for web too. New DELETE /api/library/[id] (auth-gated,
path-guarded). web 157 tests (delete happy-path + 404 + outside-root guard).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -102,6 +102,14 @@ reach the live DB automatically. Enter Qobuz / Soulseek / Last.fm credentials in
 **Settings** (they persist across rebuilds), then follow an artist or request an album
 to feed The Floor.
 
+## Managing the library
+
+Open an album on the **Library** page and use **Delete album** to remove it: the folder is
+deleted from disk and the album is dropped and un-monitored (so auto-monitor won't re-grab
+it — re-Want it from the artist page if you change your mind). This is why the `web` service
+also bind-mounts `MUSIC_DIR` at `/music` (read-write) — deletion is guarded to only ever
+remove folders strictly inside the library root.
+
 ## Backup & restore
 
 **All** durable state — library metadata, monitored/wanted lists, discovery data,