Upload new soundtracks through the API

A client starts an upload with the soundtrack's name, sends one MP3 per
request, and finishes it. The server then moves the songs into a new folder
in the music folder and syncs only that folder, so the soundtrack is in the
library, lists and search right away.

- POST /api/v1/soundtracks/uploads, GET/DELETE .../uploads/{id},
  PUT .../uploads/{id}/files/{file} and POST .../uploads/{id}/finish.
- Names must work as file names on every system and be free, ignoring case.
  File names are plain: clients flatten disc folders.
- Only MP3 files. Size limits from UPLOAD_MAX_FILE_MB (50) and
  UPLOAD_MAX_TOTAL_MB (2048).
- Refused while a sync runs, and a sync cannot start while an upload is
  finished. Songs equal to an existing soundtrack's are refused, as the sync
  would take them for that soundtrack renamed.
- Unfinished uploads live in MUSIC_PATH/.uploads and are removed after a day.
  The sync now skips every hidden folder.

Closes #33

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/openapi_test.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"testing"
 
+	"music-server/internal/backend"
 	"music-server/internal/config"
 
 	"github.com/getkin/kin-openapi/openapi3"
@@ -74,6 +75,7 @@ func TestOpenAPIDocumentsTheV1API(t *testing.T) {
 	}
 	slices.Sort(operations)
 	assert.Equal(t, []string{
+		"DELETE /api/v1/soundtracks/uploads/{id}",
 		"DELETE /api/v1/soundtracks/{uuid}/cover",
 		"DELETE /api/v1/token",
 		"GET /api/v1/character",
@@ -103,6 +105,7 @@ func TestOpenAPIDocumentsTheV1API(t *testing.T) {
 		"GET /api/v1/songs/{uuid}",
 		"GET /api/v1/songs/{uuid}/file",
 		"GET /api/v1/soundtracks",
+		"GET /api/v1/soundtracks/uploads/{id}",
 		"GET /api/v1/soundtracks/{uuid}",
 		"GET /api/v1/soundtracks/{uuid}/cover",
 		"GET /api/v1/statistics/songs/least-played",
@@ -117,11 +120,14 @@ func TestOpenAPIDocumentsTheV1API(t *testing.T) {
 		"GET /api/v1/sync/progress",
 		"GET /api/v1/version",
 		"GET /api/v1/version/history",
+		"POST /api/v1/soundtracks/uploads",
+		"POST /api/v1/soundtracks/uploads/{id}/finish",
 		"POST /api/v1/sync",
 		"POST /api/v1/sync/full",
 		"POST /api/v1/token",
 		"POST /api/v1/token/cleanup",
 		"PUT /api/v1/music/played",
+		"PUT /api/v1/soundtracks/uploads/{id}/files/{file}",
 		"PUT /api/v1/soundtracks/{uuid}/alternative-names",
 		"PUT /api/v1/soundtracks/{uuid}/cover",
 		"PUT /api/v1/soundtracks/{uuid}/cover/source",
@@ -222,6 +228,21 @@ func TestResponsesMatchOpenAPI(t *testing.T) {
 	v.check(http.MethodPut, coverURL+"/source", `{"source":"anilist","id":"42"}`, http.StatusNoContent)
 	v.check(http.MethodPut, coverURL+"/source", `{"source":"anilist","id":"7"}`, http.StatusNotFound)
 	v.check(http.MethodDelete, coverURL, "", http.StatusNoContent)
+
+	// Uploads.
+	started := v.check(http.MethodPost, "/api/v1/soundtracks/uploads", `{"name":"Uploaded"}`, http.StatusCreated)
+	var upload backend.Upload
+	require.NoError(t, json.Unmarshal(started.Body.Bytes(), &upload))
+	up := "/api/v1/soundtracks/uploads/" + upload.ID.String()
+	v.check(http.MethodPost, "/api/v1/soundtracks/uploads", `{"name":"Uploaded"}`, http.StatusConflict)
+	v.check(http.MethodPut, up+"/files/01.mp3", "ID3 song", http.StatusOK, "Content-Type", "audio/mpeg")
+	v.check(http.MethodPut, up+"/files/02.wav", "ID3 song", http.StatusBadRequest, "Content-Type", "audio/mpeg")
+	v.check(http.MethodGet, up, "", http.StatusOK)
+	v.check(http.MethodPost, up+"/finish", "", http.StatusOK)
+	v.check(http.MethodGet, up, "", http.StatusNotFound)
+	cancelled := v.check(http.MethodPost, "/api/v1/soundtracks/uploads", `{"name":"Cancelled"}`, http.StatusCreated)
+	require.NoError(t, json.Unmarshal(cancelled.Body.Bytes(), &upload))
+	v.check(http.MethodDelete, "/api/v1/soundtracks/uploads/"+upload.ID.String(), "", http.StatusNoContent)
 	v.check(http.MethodGet, "/api/v1/soundtracks/00000000-0000-0000-0000-000000000000", "", http.StatusNotFound)
 	v.check(http.MethodGet, songURL, "", http.StatusOK)
 	v.check(http.MethodGet, songURL+"/file", "", http.StatusOK)