Simplify streaming auth + add local cover extraction

Streaming: Drop token-in-URL auth entirely. Session-ID (UUID, 128-bit
entropy) IS the auth — same approach as Audiobookshelf. Eliminates the
entire class of token-related failures and matches how every other
streaming server handles this. Logs every stream request with Range
header and User-Agent for diagnostics.

Player: Visible error banner in UI when audio fails (with HTML5 media
error code translated to German). Stream URL is shown in the banner so
the user can see exactly what failed.

Scanner: Cover extraction from two new sources (in addition to API
matching):
  1. Folder-level images (cover.jpg, folder.jpg, front.jpg, etc.)
  2. Embedded artwork (ID3 APIC, MP4 covr, FLAC/Vorbis pictures)
Runs on every scan — also fills in covers for items that were already
scanned but never got one from matching.

New endpoint POST /api/items/{id}/extract-cover triggers this manually
for a single item.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/routers/matching.py

@@ -119,6 +119,37 @@ async def apply_match(
     return await _enrich_item_with_files(item, db)
 
 
+@router.post("/{item_id}/extract-cover")
+async def extract_local_cover(
+    item_id: str,
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    """Extrahiert ein Cover aus Ordner-Dateien oder eingebettetem Artwork."""
+    from ..services.scanner import _save_local_cover
+    from ..models.media_item import BookFile
+    import os
+
+    result = await db.execute(select(LibraryItem).where(LibraryItem.id == item_id))
+    item = result.scalar_one_or_none()
+    if not item:
+        raise HTTPException(status_code=404, detail="Item not found")
+
+    files_result = await db.execute(
+        select(BookFile).where(BookFile.library_item_id == item_id).order_by(BookFile.track_index)
+    )
+    audio_files = [f.path for f in files_result.scalars().all()]
+
+    cover = _save_local_cover(item.path, audio_files, item.id)
+    if cover:
+        item.cover_path = cover
+        item.updated_at = datetime.utcnow()
+        await db.commit()
+        logger.info(f"Lokales Cover gesetzt für {item_id}: {cover}")
+        return {"success": True, "cover_path": cover}
+    return {"success": False, "message": "Kein Cover gefunden"}
+
+
 @router.delete("/{item_id}/match")
 async def clear_match(
     item_id: str,