feat(web): Library Management — delete an album (files + record)

First Library Management feature. On the Library album modal, "Delete album"
(two-step confirm) removes the album:
- deletes the folder on disk (guarded to only ever remove a path strictly inside
  the library root, LYRA_LIBRARY_ROOT, default /music),
- drops the LibraryItem,
- sets the matching MonitoredRelease monitored=false + currentQualityClass=null
  so the monitor won't immediately re-download it (re-Want later to restore).

Requires the web container to see the library, so docker-compose now bind-mounts
MUSIC_DIR at /music (rw) for web too. New DELETE /api/library/[id] (auth-gated,
path-guarded). web 157 tests (delete happy-path + 404 + outside-root guard).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -27,6 +27,13 @@ services:
       # Next's standalone server binds to HOSTNAME; default is the container hostname (its own
       # IP only), so loopback healthchecks can't reach it. Bind all interfaces instead.
       HOSTNAME: 0.0.0.0
+      # Library root inside the container (matches the /music mount below) — used by the
+      # library-management delete to locate + guard which folders it may remove.
+      LYRA_LIBRARY_ROOT: /music
+    volumes:
+      # Library management (delete albums, and later manual import) needs the web to read/write
+      # the library, so mount it the same way the worker does.
+      - ${MUSIC_DIR:-./music}:/music
     ports:
       # host:container — host 8770 avoids the Quill app on 3000 (and Lidarr on 8686)
       - "8770:3000"