Simplify streaming auth + add local cover extraction

Streaming: Drop token-in-URL auth entirely. Session-ID (UUID, 128-bit
entropy) IS the auth — same approach as Audiobookshelf. Eliminates the
entire class of token-related failures and matches how every other
streaming server handles this. Logs every stream request with Range
header and User-Agent for diagnostics.

Player: Visible error banner in UI when audio fails (with HTML5 media
error code translated to German). Stream URL is shown in the banner so
the user can see exactly what failed.

Scanner: Cover extraction from two new sources (in addition to API
matching):
  1. Folder-level images (cover.jpg, folder.jpg, front.jpg, etc.)
  2. Embedded artwork (ID3 APIC, MP4 covr, FLAC/Vorbis pictures)
Runs on every scan — also fills in covers for items that were already
scanned but never got one from matching.

New endpoint POST /api/items/{id}/extract-cover triggers this manually
for a single item.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/scanner.py

@@ -2,11 +2,13 @@ import os
 import uuid
 import asyncio
 import logging
+import shutil
 from datetime import datetime
 from pathlib import Path
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
 from ..database import AsyncSessionLocal
+from ..config import get_settings
 from ..models.library import Library
 from ..models.media_item import LibraryItem, BookFile, Chapter
 from ..models.session import ScanJob
@@ -14,6 +16,8 @@ from ..models.session import ScanJob
 logger = logging.getLogger(__name__)
 
 AUDIO_EXTENSIONS = {".mp3", ".wav", ".m4a", ".flac", ".ogg", ".aac", ".m4b", ".opus"}
+COVER_NAMES = ["cover", "folder", "front", "album", "albumart", "Cover", "Folder", "Front"]
+COVER_EXTS = [".jpg", ".jpeg", ".png", ".webp"]
 
 
 def _get_audio_duration(file_path: str) -> float:
@@ -34,6 +38,94 @@ def _get_file_size(file_path: str) -> int:
         return 0
 
 
+def _find_folder_cover(folder: str) -> str | None:
+    """Sucht cover.jpg / folder.jpg / front.jpg etc. im Ordner."""
+    try:
+        for entry in os.listdir(folder):
+            name, ext = os.path.splitext(entry)
+            if ext.lower() in COVER_EXTS and name.lower() in [c.lower() for c in COVER_NAMES]:
+                return os.path.join(folder, entry)
+    except (PermissionError, FileNotFoundError):
+        pass
+    return None
+
+
+def _extract_embedded_cover(file_path: str) -> tuple[bytes, str] | None:
+    """Extrahiert eingebettetes Cover aus Audio-Datei. Gibt (bytes, ext) zurück."""
+    try:
+        from mutagen import File as MutagenFile
+        from mutagen.id3 import APIC
+        from mutagen.mp4 import MP4Cover
+        from mutagen.flac import Picture
+
+        audio = MutagenFile(file_path)
+        if not audio:
+            return None
+
+        # MP3 / ID3 (APIC)
+        if audio.tags and hasattr(audio.tags, 'getall'):
+            try:
+                apics = audio.tags.getall('APIC')
+                if apics:
+                    apic = apics[0]
+                    ext = '.png' if apic.mime == 'image/png' else '.jpg'
+                    return (apic.data, ext)
+            except Exception:
+                pass
+
+        # MP4/M4B/M4A (covr atom)
+        if audio.tags and 'covr' in audio.tags:
+            covr = audio.tags['covr']
+            if covr:
+                cover = covr[0]
+                ext = '.png' if cover.imageformat == MP4Cover.FORMAT_PNG else '.jpg'
+                return (bytes(cover), ext)
+
+        # FLAC, OGG
+        if hasattr(audio, 'pictures') and audio.pictures:
+            pic = audio.pictures[0]
+            ext = '.png' if 'png' in (pic.mime or '').lower() else '.jpg'
+            return (pic.data, ext)
+    except Exception as e:
+        logger.debug(f"Cover-Extraktion fehlgeschlagen für {file_path}: {e}")
+    return None
+
+
+def _save_local_cover(folder_path: str, audio_files: list[str], item_id: str) -> str | None:
+    """Findet ein Cover (Ordner-Datei oder Embed) und speichert es lokal."""
+    settings = get_settings()
+    covers_dir = settings.covers_dir
+    os.makedirs(covers_dir, exist_ok=True)
+
+    folder_cover = _find_folder_cover(folder_path)
+    if folder_cover:
+        ext = os.path.splitext(folder_cover)[1].lower()
+        if ext not in COVER_EXTS:
+            ext = ".jpg"
+        dest = os.path.join(covers_dir, f"{item_id}{ext}")
+        try:
+            shutil.copyfile(folder_cover, dest)
+            logger.info(f"Ordner-Cover übernommen: {folder_cover} → {dest}")
+            return dest
+        except Exception as e:
+            logger.warning(f"Cover-Copy fehlgeschlagen: {e}")
+
+    for f in audio_files[:1]:
+        result = _extract_embedded_cover(f)
+        if result:
+            data, ext = result
+            if len(data) > 1000:
+                dest = os.path.join(covers_dir, f"{item_id}{ext}")
+                try:
+                    with open(dest, "wb") as fd:
+                        fd.write(data)
+                    logger.info(f"Embedded Cover extrahiert: {f} → {dest} ({len(data)} Bytes)")
+                    return dest
+                except Exception as e:
+                    logger.warning(f"Cover-Save fehlgeschlagen: {e}")
+    return None
+
+
 def _guess_title_from_path(folder_path: str) -> str:
     """Leitet Titel aus dem Ordnernamen ab."""
     return os.path.basename(folder_path)
@@ -135,9 +227,15 @@ async def scan_library_task(library_id: str, job_id: str):
                     existing_item.is_missing = False
                     existing_item.updated_at = datetime.utcnow()
                     item = existing_item
+                    # Cover aus Ordner/Embed nachziehen falls noch keins da ist
+                    if not item.cover_path or not os.path.exists(item.cover_path or ""):
+                        local_cover = _save_local_cover(folder_path, audio_files, item.id)
+                        if local_cover:
+                            item.cover_path = local_cover
                 else:
                     item_id = str(uuid.uuid4())
                     title = _guess_title_from_path(folder_path)
+                    local_cover = _save_local_cover(folder_path, audio_files, item_id)
                     item = LibraryItem(
                         id=item_id,
                         library_id=library_id,
@@ -148,6 +246,7 @@ async def scan_library_task(library_id: str, job_id: str):
                         duration_seconds=total_duration,
                         size_bytes=total_size,
                         num_files=len(audio_files),
+                        cover_path=local_cover,
                         tags=["zu_prüfen"],
                     )
                     db.add(item)