Upload new soundtracks through the API

A client starts an upload with the soundtrack's name, sends one MP3 per
request, and finishes it. The server then moves the songs into a new folder
in the music folder and syncs only that folder, so the soundtrack is in the
library, lists and search right away.

- POST /api/v1/soundtracks/uploads, GET/DELETE .../uploads/{id},
  PUT .../uploads/{id}/files/{file} and POST .../uploads/{id}/finish.
- Names must work as file names on every system and be free, ignoring case.
  File names are plain: clients flatten disc folders.
- Only MP3 files. Size limits from UPLOAD_MAX_FILE_MB (50) and
  UPLOAD_MAX_TOTAL_MB (2048).
- Refused while a sync runs, and a sync cannot start while an upload is
  finished. Songs equal to an existing soundtrack's are refused, as the sync
  would take them for that soundtrack renamed.
- Unfinished uploads live in MUSIC_PATH/.uploads and are removed after a day.
  The sync now skips every hidden folder.

Closes #33

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -27,7 +27,8 @@ COPY --from=build /app/main .
 COPY --from=frontend /usr/share/nginx/html /frontend
 COPY ./songs/ ./songs/
 
-# The music volume must be readable by uid 1000, and writable for the .id file cleanup during sync.
+# The music volume must be readable by uid 1000, and writable for the .id file cleanup during sync
+# and for soundtrack uploads (kept in .uploads until finished).
 USER 1000:1000
 EXPOSE 8080
 # Prometheus metrics (METRICS_PORT). Keep it off the public proxy.
@@ -38,6 +39,7 @@ VOLUME /characters
 # Required: DB_HOST, DB_PORT, DB_USERNAME, DB_PASSWORD, DB_NAME, MUSIC_PATH, CHARACTERS_PATH
 # Covers (optional): COVERS_PATH, a writable folder such as a /covers volume, turns covers on.
 # STEAMGRIDDB_API_KEY also turns on the automatic search (SteamGridDB, then AniList).
+# Uploads (optional): UPLOAD_MAX_FILE_MB (default 50) and UPLOAD_MAX_TOTAL_MB (default 2048).
 ENV PORT=8080
 
 CMD ["./main"]