soulsync 2.8.7: dev → main

the soulsync-made discovery playlists become first-class auto-sync items, plus a fix for the settings page quietly wiping saved API secrets.

schedule SoulSync Discovery playlists straight from Auto-Sync

every discovery playlist soulsync makes now shows up in the auto-sync schedule modal: Time Machine (per decade), Genre, Seasonal, Daily Mix, plus the singletons (Popular Picks, Hidden Gems, The Archives, Fresh Tape, Discovery Shuffle).

• flip a schedule on and it generates itself on the first run and keeps syncing on your interval. no more going to the discover page to "generate" it first.
• the many-variant kinds (Time Machine, Genre, Seasonal) collapse into one expandable row per kind, so the list isn't a wall of decades and genres.
• track counts show even for a playlist you've generated but not yet synced, instead of a misleading "0 tracks".
• orphaned or empty discovery playlists (leftovers from a removed generator) no longer clutter the board.

built additively: the synthetic rows ride the board's existing numeric-id machinery with negative ids, so scheduling / drag-drop / run-now all work unchanged. covered by JS unit tests + backend tests.

saving settings can't wipe a stored API secret anymore (#992)

reported as Spotify failing to authenticate with invalid_client even after rotating and re-entering the client secret. the credentials were fine (the reporter proved the same id/secret get a token straight from Spotify). the bug was on our side.

root cause: the settings page auto-saves ~2s after any input. a masked secret field is cleared to '' on focus so you can type fresh, and a timer landing in that window posted the empty string. ConfigManager.set() only refused to overwrite the redaction sentinel, not '', so it persisted the empty value and wiped the real secret. an empty secret is sent as-is and Spotify rejects the token exchange with invalid_client. it explains why re-entering never stuck (the "clear the box first" step maximizes the empty-save window) and why a standalone script with the same creds worked.

this wasn't Spotify-only. every masked credential (Tidal, Deezer, Discogs, Last.fm, Genius, AcoustID, ListenBrainz, Qobuz, Plex, Jellyfin, and the rest) shared the exact code path. Spotify just fails loudly enough to get reported. the set-once API keys rarely hit the timing window; an interactive re-auth dance does.

fix: set() now treats '' / None for a sensitive path the same as the sentinel: keep the existing value. clearing a credential is done via its explicit disconnect action, never by saving an empty form. one guard at the single chokepoint, so it covers every secret at once. disconnect flows clear token blobs via {}, which is unaffected. updated the test that had encoded the footgun.

navidrome playlist cover art (#993)

mirrored playlists now push their cover art to Navidrome when they sync, so a synced playlist shows the right artwork instead of a blank tile. the art goes up on the first mirror, not re-pushed on every sync.

artist discography declutter

a browsed artist now shows just the studio catalog by default, hiding live albums, compilations, and singles. reads strictly from MusicBrainz so the main view stays clean.