feat(playlist): add custom playlist cover art upload (#5110)

* feat(playlist): add custom playlist cover art upload - #406

Allow users to upload, view, and remove custom cover images for playlists.
Custom images take priority over the auto-generated tiled artwork.

Backend:
- Add `image_path` column to playlist table (migration with proper rollback)
- Add `SetImage`/`RemoveImage` methods to playlist service
- Add `POST/DELETE /api/playlist/{id}/image` endpoints
- Prioritize custom image in artwork reader pipeline
- Clean up image files on playlist deletion
- Use glob-based cleanup to prevent orphaned files across format changes
- Reject uploads with undetermined image type (400)

Frontend:
- Hover overlay on playlist cover with upload (camera) and remove (trash) buttons
- Lightbox for full-size cover art viewing
- Cover art thumbnails in the playlist list view
- Loading/error states and i18n strings

Closes #406

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: adrbn <128328324+adrbn@users.noreply.github.com>

* refactor: rename playlist image path migration file

Signed-off-by: Deluan <deluan@navidrome.org>

* fix(playlist): address review feedback for cover art upload - #406

- Use httpClient instead of raw fetch for image upload/remove
- Revert glob cleanup to simple imagePath check
- Add log.Error before all error HTTP responses
- Add backend tests for SetImage and RemoveImage

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: adrbn <128328324+adrbn@users.noreply.github.com>

* refactor(playlist): use Playlist.ArtworkPath() for image storage

Migrate all playlist image path handling to use the new
Playlist.ArtworkPath() method as the single source of truth. The DB now
stores only the filename (e.g. "pls-1.jpg") instead of a relative path,
and images are stored under {DataFolder}/artwork/playlist/ instead of
{DataFolder}/playlist_images/. The artwork root directory is created at
startup alongside DataFolder and CacheFolder. This also removes the
conf dependency from reader_playlist.go since path resolution is now
fully encapsulated in the model.

Signed-off-by: Deluan <deluan@navidrome.org>

* refactor(playlist): streamline artwork image selection logic

Signed-off-by: Deluan <deluan@navidrome.org>

* refactor: move translation keys, add pt-BR translations

Signed-off-by: Deluan <deluan@navidrome.org>

* refactor(playlist): rename image_path to image_file

Rename the playlist cover art column and field from image_path/ImagePath
to image_file/ImageFile across the migration, model, service, tests, and
UI. The new name more accurately describes what the field stores (a
filename, not a path) and aligns with the existing ImageFiles/IsImageFile
naming conventions in the codebase.

---------

Signed-off-by: adrbn <128328324+adrbn@users.noreply.github.com>
Signed-off-by: Deluan <deluan@navidrome.org>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Deluan Quintão <deluan@navidrome.org>

server/nativeapi/playlists.go

@@ -5,7 +5,13 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"image"
+	_ "image/gif"
+	_ "image/jpeg"
+	_ "image/png"
+	"io"
 	"net/http"
+	"path/filepath"
 	"strconv"
 	"strings"
 
@@ -15,6 +21,7 @@ import (
 	"github.com/navidrome/navidrome/log"
 	"github.com/navidrome/navidrome/model"
 	"github.com/navidrome/navidrome/utils/req"
+	_ "golang.org/x/image/webp"
 )
 
 type restHandler = func(rest.RepositoryConstructor, ...rest.Logger) http.HandlerFunc
@@ -224,3 +231,101 @@ func getSongPlaylists(svc playlists.Playlists) http.HandlerFunc {
 		_, _ = w.Write(data) //nolint:gosec
 	}
 }
+
+const maxImageSize = 10 << 20 // 10MB
+
+func uploadPlaylistImage(pls playlists.Playlists) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		p := req.Params(r)
+		playlistId, _ := p.String(":id")
+
+		if err := r.ParseMultipartForm(maxImageSize); err != nil {
+			log.Error(ctx, "Error parsing multipart form", err)
+			http.Error(w, "file too large or invalid form", http.StatusBadRequest)
+			return
+		}
+
+		file, header, err := r.FormFile("image")
+		if err != nil {
+			log.Error(ctx, "Error reading uploaded file", err)
+			http.Error(w, "missing image file", http.StatusBadRequest)
+			return
+		}
+		defer file.Close()
+
+		// Validate the uploaded file is a valid image
+		_, format, err := image.DecodeConfig(file)
+		if err != nil {
+			log.Error(ctx, "Uploaded file is not a valid image", err)
+			http.Error(w, "invalid image file", http.StatusBadRequest)
+			return
+		}
+
+		// Reset reader after DecodeConfig consumed some bytes
+		if seeker, ok := file.(io.Seeker); ok {
+			if _, err := seeker.Seek(0, io.SeekStart); err != nil {
+				log.Error(ctx, "Error seeking file", err)
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+				return
+			}
+		}
+
+		// Determine file extension from decoded format or original filename
+		ext := "." + format
+		if ext == "." {
+			ext = strings.ToLower(filepath.Ext(header.Filename))
+		}
+		if ext == "" || ext == "." {
+			log.Error(ctx, "Could not determine image type", "playlistId", playlistId, "filename", header.Filename)
+			http.Error(w, "could not determine image type", http.StatusBadRequest)
+			return
+		}
+
+		err = pls.SetImage(ctx, playlistId, file, ext)
+		if errors.Is(err, model.ErrNotAuthorized) {
+			log.Error(ctx, "Not authorized to upload playlist image", "playlistId", playlistId, err)
+			http.Error(w, "not authorized", http.StatusForbidden)
+			return
+		}
+		if errors.Is(err, model.ErrNotFound) {
+			log.Error(ctx, "Playlist not found for image upload", "playlistId", playlistId, err)
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		if err != nil {
+			log.Error(ctx, "Error saving playlist image", "playlistId", playlistId, err)
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		_, _ = fmt.Fprintf(w, `{"status":"ok"}`) //nolint:gosec
+	}
+}
+
+func deletePlaylistImage(pls playlists.Playlists) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		p := req.Params(r)
+		playlistId, _ := p.String(":id")
+
+		err := pls.RemoveImage(ctx, playlistId)
+		if errors.Is(err, model.ErrNotAuthorized) {
+			log.Error(ctx, "Not authorized to remove playlist image", "playlistId", playlistId, err)
+			http.Error(w, "not authorized", http.StatusForbidden)
+			return
+		}
+		if errors.Is(err, model.ErrNotFound) {
+			log.Error(ctx, "Playlist not found for image removal", "playlistId", playlistId, err)
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		if err != nil {
+			log.Error(ctx, "Error removing playlist image", "playlistId", playlistId, err)
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		_, _ = fmt.Fprintf(w, `{"status":"ok"}`) //nolint:gosec
+	}
+}