feat: share links, mobile lyrics, double-tap play, hardening (v1.6.1)

Closes #121, #125, #136, #138. Partially addresses #139, #25, #108, #30.

Share links: generate shareable URLs for playlists/tracks/albums with
public playback page, token-based access, expiry, and play limits.

Mobile lyrics: replace album art with scrollable lyrics view when
active. Synced lyrics auto-scroll; plain lyrics freely scrollable.

Mobile double-tap: custom touch handler with 300ms window across all
7 track list components. Desktop double-click preserved.

Security: path traversal containment in getLocalImagePath/getResizedImagePath,
stream error handling via streamFileWithRangeSupport, scoped JSON body limit.

Enrichment: sequential audio/vibe phases (no simultaneous ML models),
heroUrl preservation in manual enrichment, scanner deep-to-shallow iteration.

UI: playlist inline rename, player queue/add-to-playlist buttons,
error toasts on silent catch blocks, activity panel listener stability,
dead handleSeek wrappers removed, query key standardization.

Author: Your Name

CHANGELOG.md

@@ -1,6 +1,6 @@
 {
     "name": "kima-backend",
-    "version": "1.6.0",
+    "version": "1.6.1",
     "description": "Kima backend API server",
     "license": "GPL-3.0",
     "repository": {

backend/package.json

@@ -0,0 +1,23 @@
+-- CreateTable
+CREATE TABLE "share_links" (
+    "id" TEXT NOT NULL,
+    "token" TEXT NOT NULL,
+    "entityType" TEXT NOT NULL,
+    "entityId" TEXT NOT NULL,
+    "createdBy" TEXT NOT NULL,
+    "expiresAt" TIMESTAMP(3),
+    "maxPlays" INTEGER,
+    "playCount" INTEGER NOT NULL DEFAULT 0,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "share_links_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "share_links_token_key" ON "share_links"("token");
+
+-- CreateIndex
+CREATE INDEX "share_links_entityType_entityId_idx" ON "share_links"("entityType", "entityId");
+
+-- AddForeignKey
+ALTER TABLE "share_links" ADD CONSTRAINT "share_links_createdBy_fkey" FOREIGN KEY ("createdBy") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;

backend/prisma/migrations/20260302000000_add_share_links/migration.sql

@@ -720,6 +720,7 @@ model User {
   unavailableAlbums      UnavailableAlbum[]
   discoverConfig         UserDiscoverConfig?
   settings               UserSettings?
+  shareLinks             ShareLink[]
 }
 
 model UserDiscoverConfig {
@@ -816,6 +817,22 @@ model TrackLyrics {
   @@map("track_lyrics")
 }
 
+model ShareLink {
+  id         String    @id @default(cuid())
+  token      String    @unique
+  entityType String
+  entityId   String
+  createdBy  String
+  expiresAt  DateTime?
+  maxPlays   Int?
+  playCount  Int       @default(0)
+  createdAt  DateTime  @default(now())
+  user       User      @relation(fields: [createdBy], references: [id], onDelete: Cascade)
+
+  @@index([entityType, entityId])
+  @@map("share_links")
+}
+
 enum AlbumLocation {
   LIBRARY
   DISCOVER

backend/prisma/schema.prisma

@@ -39,6 +39,7 @@ import analysisRoutes from "./routes/analysis";
 import releasesRoutes from "./routes/releases";
 import vibeRoutes from "./routes/vibe";
 import systemRoutes from "./routes/system";
+import shareRoutes from "./routes/share";
 import eventsRoutes from "./routes/events";
 import { subsonicRouter } from "./routes/subsonic/index";
 import { dataCacheService } from "./services/dataCache";
@@ -94,7 +95,14 @@ app.use(
         credentials: true,
     })
 );
-app.use(express.json({ limit: "1mb" })); // Increased from 100KB default to support large queue payloads
+const defaultJsonParser = express.json({ limit: "1mb" });
+const largeJsonParser = express.json({ limit: "5mb" });
+app.use((req, res, next) => {
+    if (req.path.startsWith("/api/playback-state")) {
+        return largeJsonParser(req, res, next);
+    }
+    return defaultJsonParser(req, res, next);
+});
 
 // Session
 // Trust proxy for reverse proxy setups (nginx, traefik, etc.)
@@ -130,6 +138,9 @@ app.use("/api/auth", authRoutes);
 app.use("/api/onboarding/register", authLimiter);
 app.use("/api/onboarding", onboardingRoutes);
 
+// Public share routes (GET/stream are unauthenticated; POST/DELETE self-protect with requireAuth)
+app.use("/api/share", shareRoutes);
+
 // Apply general API rate limiting to all API routes
 app.use("/api/api-keys", apiLimiter, apiKeysRoutes);
 app.use("/api/device-link", apiLimiter, deviceLinkRoutes);

backend/src/index.ts

@@ -58,7 +58,7 @@ router.post("/", requireAuth, async (req, res) => {
             // Filter out any invalid items first
             try {
                 safeQueue = queue
-                    .slice(0, 100)
+                    .slice(0, 2000)
                     .filter((item: any) => item && item.id) // Must have at least an ID
                     .map((item: any) => ({
                         id: String(item.id || ""),