Upload new soundtracks through the API

A client starts an upload with the soundtrack's name, sends one MP3 per
request, and finishes it. The server then moves the songs into a new folder
in the music folder and syncs only that folder, so the soundtrack is in the
library, lists and search right away.

- POST /api/v1/soundtracks/uploads, GET/DELETE .../uploads/{id},
  PUT .../uploads/{id}/files/{file} and POST .../uploads/{id}/finish.
- Names must work as file names on every system and be free, ignoring case.
  File names are plain: clients flatten disc folders.
- Only MP3 files. Size limits from UPLOAD_MAX_FILE_MB (50) and
  UPLOAD_MAX_TOTAL_MB (2048).
- Refused while a sync runs, and a sync cannot start while an upload is
  finished. Songs equal to an existing soundtrack's are refused, as the sync
  would take them for that soundtrack renamed.
- Unfinished uploads live in MUSIC_PATH/.uploads and are removed after a day.
  The sync now skips every hidden folder.

Closes #33

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/config_test.go

@@ -37,6 +37,27 @@ func TestLoadDefaults(t *testing.T) {
 	assert.Empty(t, cfg.SteamGridDBAPIKey)
 }
 
+func TestLoadUploadLimits(t *testing.T) {
+	cfg, err := load(env(validEnv()))
+	require.NoError(t, err)
+	assert.Equal(t, int64(DefaultUploadMaxFileMB<<20), cfg.UploadMaxFileSize)
+	assert.Equal(t, int64(DefaultUploadMaxTotalMB<<20), cfg.UploadMaxTotalSize)
+
+	values := validEnv()
+	values["UPLOAD_MAX_FILE_MB"] = "100"
+	values["UPLOAD_MAX_TOTAL_MB"] = "500"
+	cfg, err = load(env(values))
+	require.NoError(t, err)
+	assert.Equal(t, int64(100<<20), cfg.UploadMaxFileSize)
+	assert.Equal(t, int64(500<<20), cfg.UploadMaxTotalSize)
+
+	for _, invalid := range []string{"0", "-5", "lots", "1.5"} {
+		values["UPLOAD_MAX_FILE_MB"] = invalid
+		_, err = load(env(values))
+		assert.ErrorContains(t, err, "UPLOAD_MAX_FILE_MB", invalid)
+	}
+}
+
 func TestLoadCovers(t *testing.T) {
 	values := validEnv()
 	values["COVERS_PATH"] = "/covers"