Upload new soundtracks through the API

A client starts an upload with the soundtrack's name, sends one MP3 per
request, and finishes it. The server then moves the songs into a new folder
in the music folder and syncs only that folder, so the soundtrack is in the
library, lists and search right away.

- POST /api/v1/soundtracks/uploads, GET/DELETE .../uploads/{id},
  PUT .../uploads/{id}/files/{file} and POST .../uploads/{id}/finish.
- Names must work as file names on every system and be free, ignoring case.
  File names are plain: clients flatten disc folders.
- Only MP3 files. Size limits from UPLOAD_MAX_FILE_MB (50) and
  UPLOAD_MAX_TOTAL_MB (2048).
- Refused while a sync runs, and a sync cannot start while an upload is
  finished. Songs equal to an existing soundtrack's are refused, as the sync
  would take them for that soundtrack renamed.
- Unfinished uploads live in MUSIC_PATH/.uploads and are removed after a day.
  The sync now skips every hidden folder.

Closes #33

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/config.go

@@ -31,6 +31,11 @@ type Config struct {
 	CharactersPath string
 	SoundCheckPath string
 	FrontendPath   string
+	// UploadMaxFileSize and UploadMaxTotalSize limit uploaded songs, in bytes: one song and
+	// all songs of one uploaded soundtrack.
+	UploadMaxFileSize  int64
+	UploadMaxTotalSize int64
+
 	// CoversPath is the folder for soundtrack covers. Empty turns covers off.
 	CoversPath string
 
@@ -90,6 +95,15 @@ func load(getenv func(string) string) (Config, error) {
 	}
 	cfg.Port = port
 
+	cfg.UploadMaxFileSize, err = parseMegabytes(getenv("UPLOAD_MAX_FILE_MB"), DefaultUploadMaxFileMB)
+	if err != nil {
+		errs = append(errs, fmt.Errorf("UPLOAD_MAX_FILE_MB: %w", err))
+	}
+	cfg.UploadMaxTotalSize, err = parseMegabytes(getenv("UPLOAD_MAX_TOTAL_MB"), DefaultUploadMaxTotalMB)
+	if err != nil {
+		errs = append(errs, fmt.Errorf("UPLOAD_MAX_TOTAL_MB: %w", err))
+	}
+
 	cfg.MetricsPort, err = parseMetricsPort(getenv("METRICS_PORT"))
 	if err != nil {
 		errs = append(errs, fmt.Errorf("METRICS_PORT: %w", err))
@@ -138,6 +152,24 @@ func parseCIDRs(value string) ([]*net.IPNet, error) {
 	return nets, nil
 }
 
+// Upload size limits in MB, used when UPLOAD_MAX_FILE_MB and UPLOAD_MAX_TOTAL_MB are not set.
+const (
+	DefaultUploadMaxFileMB  = 50
+	DefaultUploadMaxTotalMB = 2048
+)
+
+// parseMegabytes reads a positive number of megabytes and returns it in bytes.
+func parseMegabytes(value string, defaultMB int64) (int64, error) {
+	if value == "" {
+		return defaultMB << 20, nil
+	}
+	mb, err := strconv.ParseInt(value, 10, 64)
+	if err != nil || mb < 1 || mb > 1<<20 {
+		return 0, fmt.Errorf("%q is not a number of megabytes", value)
+	}
+	return mb << 20, nil
+}
+
 // DefaultMetricsPort is used when METRICS_PORT is not set.
 const DefaultMetricsPort = 2112