fix: issue triage -- #155 #156 #154 #25, CI hardening, E2E improvements

Issue fixes:
- #155: /api/browse/playlists/parse now handles YouTube/YouTube Music URLs
- #156: stop passing album MBID to verifyArtistName (was calling MB /artist/{id}
  with an album MBID, always 404d); fix spotify trackCount stale value
- #154: remove hardcoded port-3030 detection from getApiBaseUrl -- now returns
  relative URLs by default so any host:port mapping works
- #25 (partial): fix spotify playlist trackCount to use tracks.length instead of
  stale playlist.tracks.total after pagination

Dead code / quality:
- Remove unused rootFolderPath param from processDownload + call sites
- Remove unused req params in route handlers (prefix _req)
- Remove dead push condition from integration.yml job gate
- Remove dead baseUrl constructor param and private field from ApiService
- Fix LibraryTabs hover effect: remove inline style={{ opacity: 0.1 }} that
  overrode Tailwind group-hover; change to group-hover:opacity-10
- Fix mobile tab centering in LibraryTabs (add justify-center)

CI security:
- Mask TEST_PASS before writing to GITHUB_ENV in all three workflow files
- Add missing concurrency block to nightly.yml
- Add username validation + remove credential echo in create-e2e-user.sh
- Fix global.setup.ts error message to mention .env.test

E2E:
- Fix vibe test race condition: replace Promise.race + transient text with
  stable trackCount.or(noData) assertion
- Fix security test flakiness: toBe(beforeCount) -> not.toBeGreaterThan for
  playlist count check (parallel tests can delete playlists concurrently)
- Fix global.setup.ts error message to reference .env.test file

Vibe map:
- Increase cluster label size (13->15 / 10->12 px) and opacity (50->70 / 35->50)
  for slightly better readability

.github/workflows/integration.yml

@@ -13,7 +13,7 @@ concurrency:
 jobs:
     e2e:
         name: E2E Tests
-        if: github.event_name == 'push' || github.event.label.name == 'run-e2e'
+        if: github.event_name == 'workflow_dispatch' || github.event.label.name == 'run-e2e'
         runs-on: ubuntu-latest
         timeout-minutes: 60
 
@@ -48,6 +48,7 @@ jobs:
               run: |
                   TEST_USER="kima_e2e"
                   TEST_PASS="$(openssl rand -hex 20)"
+                  echo "::add-mask::${TEST_PASS}"
                   echo "KIMA_TEST_USERNAME=${TEST_USER}" >> "$GITHUB_ENV"
                   echo "KIMA_TEST_PASSWORD=${TEST_PASS}" >> "$GITHUB_ENV"
                   KIMA_CONTAINER=kima-e2e \

.github/workflows/nightly.yml

@@ -5,6 +5,10 @@ on:
         - cron: "0 3 * * *"
     workflow_dispatch:
 
+concurrency:
+    group: nightly
+    cancel-in-progress: true
+
 jobs:
     full-e2e:
         name: Full E2E Suite
@@ -44,6 +48,7 @@ jobs:
                   # Generate random credentials for this run -- no hardcoded passwords in source.
                   TEST_USER="kima_e2e"
                   TEST_PASS="$(openssl rand -hex 20)"
+                  echo "::add-mask::${TEST_PASS}"
                   echo "KIMA_TEST_USERNAME=${TEST_USER}" >> "$GITHUB_ENV"
                   echo "KIMA_TEST_PASSWORD=${TEST_PASS}" >> "$GITHUB_ENV"
                   KIMA_CONTAINER=kima-nightly \

.github/workflows/security.yml

@@ -65,6 +65,7 @@ jobs:
               run: |
                   TEST_USER="kima_e2e"
                   TEST_PASS="$(openssl rand -hex 20)"
+                  echo "::add-mask::${TEST_PASS}"
                   echo "KIMA_TEST_USERNAME=${TEST_USER}" >> "$GITHUB_ENV"
                   echo "KIMA_TEST_PASSWORD=${TEST_PASS}" >> "$GITHUB_ENV"
                   KIMA_CONTAINER=kima-security \