2.6.9

mostly a security release on top of a week of issue fixes.

security (the headline)

launch PIN is enforced server-side now (#832) — it was only enforced in the browser, so it could be bypassed; matters most if you expose soulsync publicly. now a real server-side gate — unverified sessions can't reach anything but the unlock flow.
saved secrets stop reaching the browser — the settings page was loading your stored api keys, tokens, and passwords into the client. now masked before they leave the server; saving an untouched form keeps the real value.

#833 delete works on tracks with curly apostrophes again — db stored U+2019, disk had U+0027, so it deleted the row but left the file. resolution now folds typographic look-alikes (curly vs straight quotes, dashes) to find the real file. fixes existing files, no re-import.
#831 full watchlist live-scan revamp — bespoke live deck (big portrait, progress bar, found/added feed, zero layout shift) + a persistent per-run scan history modal.
#830 discography downloads explain why tracks were skipped instead of a flat "no new tracks", and credit collab tracks right.
#829 album downloads reuse the existing folder instead of splitting into a second one.
#828 dead file cleaner stops flagging a whole library when the paths are just unreachable.
#827 settings stop flooding app.log from the logs tab.
#825 owned tracks stop coming back to the wishlist (manual-add ownership check + matcher no longer reads a bracketed subtitle as a different song).
#824 full yyyy-mm-dd release dates written to tags instead of just the year.
#823 append sync stops re-adding every track + honors your configured sync mode.
#740 wishlist album bundles no longer jam the shared download pool (sokhi).
spotify "free" → renamed "spotify (no auth)", now the enrichment default, with album search + a working budget→free bridge.
multi-artist tags finally apply on search → download now (netti93).
decimal-volume albums (vol 4 vs vol 4.5) no longer treated as duplicates.

version bumped to 2.6.9 (web_server + docker-publish default), what's new modal updated.
every fix landed with seam-level + regression tests; suite green (one pre-existing soundcloud mock failure, unrelated).

full list in the what's new modal.