feat: nginx reverse proxy, Spotify import, overlay system, UI overhaul

- Add nginx as single entry point: /api/* → backend, /* → web
- NEXT_PUBLIC_API_URL="" so all API calls are relative (go through nginx)
- Add Spotify playlist import (Client Credentials OAuth, up to 500 tracks)
- Add Yandex/Spotify tabbed import UI on /playlists
- Add stream overlay system (SSE + polling fallback, 9 styles)
- Reorganize pages into (main) route group
- Add QueuePanel, VersionsPanel, Toaster components
- Add overlay settings tab in /settings

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -29,8 +29,9 @@ services:
       GIN_MODE: release
       PORT: 8080
       JWT_SECRET: ${JWT_SECRET}
-    ports:
-      - "8081:8080"
+      ALLOWED_ORIGINS: ${ALLOWED_ORIGINS:-http://localhost}
+      SPOTIFY_CLIENT_ID: ${SPOTIFY_CLIENT_ID:-}
+      SPOTIFY_CLIENT_SECRET: ${SPOTIFY_CLIENT_SECRET:-}
     depends_on:
       postgres:
         condition: service_healthy
@@ -41,14 +42,21 @@ services:
       context: ./apps/web
       dockerfile: Dockerfile
       args:
-        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:8080}
-    environment:
-      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:8080}
-    ports:
-      - "3001:3000"
+        NEXT_PUBLIC_API_URL: ""
     depends_on:
       - backend
     restart: unless-stopped
 
+  nginx:
+    image: nginx:alpine
+    volumes:
+      - ./apps/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+    ports:
+      - "${APP_PORT:-80}:80"
+    depends_on:
+      - web
+      - backend
+    restart: unless-stopped
+
 volumes:
   postgres_data: