feat(web): Library Management — delete an album (files + record)

First Library Management feature. On the Library album modal, "Delete album"
(two-step confirm) removes the album:
- deletes the folder on disk (guarded to only ever remove a path strictly inside
  the library root, LYRA_LIBRARY_ROOT, default /music),
- drops the LibraryItem,
- sets the matching MonitoredRelease monitored=false + currentQualityClass=null
  so the monitor won't immediately re-download it (re-Want later to restore).

Requires the web container to see the library, so docker-compose now bind-mounts
MUSIC_DIR at /music (rw) for web too. New DELETE /api/library/[id] (auth-gated,
path-guarded). web 157 tests (delete happy-path + 404 + outside-root guard).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/app/api/library/[id]/route.test.ts

@@ -0,0 +1,61 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, writeFileSync, existsSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { prisma } from "@/lib/db";
+import { DELETE } from "./route";
+
+let root: string;
+const original = process.env.LYRA_LIBRARY_ROOT;
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "lyra-lib-"));
+  process.env.LYRA_LIBRARY_ROOT = root;
+});
+afterEach(() => {
+  if (original === undefined) delete process.env.LYRA_LIBRARY_ROOT;
+  else process.env.LYRA_LIBRARY_ROOT = original;
+  rmSync(root, { recursive: true, force: true });
+});
+
+function req(id: string) {
+  return { params: Promise.resolve({ id }) };
+}
+
+describe("DELETE /api/library/[id]", () => {
+  it("deletes the folder, the record, and stops monitoring the release", async () => {
+    const dir = join(root, "Artist", "Album (2020)");
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, "01 Track.flac"), "audio");
+
+    const item = await prisma.libraryItem.create({
+      data: { artist: "Artist", album: "Album", path: dir, source: "scan", format: "FLAC", qualityClass: 3 },
+    });
+    const wa = await prisma.watchedArtist.create({ data: { mbid: "a1", name: "Artist" } });
+    await prisma.monitoredRelease.create({
+      data: { watchedArtistId: wa.id, artistMbid: "a1", artistName: "Artist", rgMbid: "rg1",
+        album: "Album", secondaryTypes: [], monitored: true, state: "fulfilled", currentQualityClass: 3 },
+    });
+
+    const res = await DELETE(new Request("http://x"), req(item.id));
+    expect(res.status).toBe(200);
+    expect(existsSync(dir)).toBe(false); // files gone
+    expect(await prisma.libraryItem.findUnique({ where: { id: item.id } })).toBeNull();
+    const mr = await prisma.monitoredRelease.findFirst({ where: { rgMbid: "rg1" } });
+    expect(mr).toMatchObject({ monitored: false, currentQualityClass: null }); // won't be re-grabbed
+  });
+
+  it("404s for an unknown id", async () => {
+    expect((await DELETE(new Request("http://x"), req("nope"))).status).toBe(404);
+  });
+
+  it("refuses to delete a path outside the library root", async () => {
+    const item = await prisma.libraryItem.create({
+      data: { artist: "X", album: "Y", path: "/etc", source: "scan", format: "FLAC", qualityClass: 1 },
+    });
+    const res = await DELETE(new Request("http://x"), req(item.id));
+    expect(res.status).toBe(400);
+    // the record is preserved when the path guard trips
+    expect(await prisma.libraryItem.findUnique({ where: { id: item.id } })).not.toBeNull();
+  });
+});

web/src/app/api/library/[id]/route.ts

@@ -0,0 +1,36 @@
+import { rm } from "node:fs/promises";
+import { resolve, sep } from "node:path";
+import { prisma } from "@/lib/db";
+
+// DELETE /api/library/[id] — remove an owned album: delete its folder on disk, drop the
+// LibraryItem, and stop monitoring the matching release so the monitor doesn't re-grab it.
+export async function DELETE(_request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params;
+  const item = await prisma.libraryItem.findUnique({ where: { id } });
+  if (!item) return Response.json({ error: "not found" }, { status: 404 });
+
+  // Guard: only ever delete a folder strictly inside the library root.
+  const root = resolve(process.env.LYRA_LIBRARY_ROOT ?? "/music");
+  const target = resolve(item.path);
+  if (target === root || !target.startsWith(root + sep)) {
+    return Response.json({ error: "refusing to delete a path outside the library" }, { status: 400 });
+  }
+
+  try {
+    await rm(target, { recursive: true, force: true });
+  } catch {
+    return Response.json({ error: "failed to delete files on disk" }, { status: 500 });
+  }
+
+  // Drop the record + stop monitoring so auto-monitor won't immediately re-download it. The
+  // release stays in the artist's discography (dormant) and can be re-wanted later.
+  await prisma.$transaction([
+    prisma.libraryItem.delete({ where: { id } }),
+    prisma.monitoredRelease.updateMany({
+      where: { artistName: item.artist, album: item.album },
+      data: { monitored: false, currentQualityClass: null },
+    }),
+  ]);
+
+  return Response.json({ ok: true });
+}