music: fix stale cover/meta on the clients (cache revalidation) + purge removed covers

Two problems behind "deleted/changed the folder image but it still shows" (on
both web and app):

1. Client caching. Cover/meta/etc. were served with an ETag(=v) but NO
   Cache-Control, so browsers served them straight from the heuristic cache at
   the same URL — a changed cover kept showing the old image. And the platform
   proxy never forwarded If-None-Match, so the ETag revalidation couldn't work
   anyway. Now the sidecar sends `Cache-Control: no-cache` on every version-
   stamped artifact (cover/meta/poster/lyrics/image) + the manifest, and the
   proxy forwards If-None-Match → the client revalidates every time and gets a
   cheap 304 when unchanged, a fresh 200 when v changed.

2. Removed covers lingered. On rebuild the indexer only (over)wrote cover.jpg
   when a source cover existed — a deleted or now-undecodable source left the
   old cover.jpg in the cache (still served, still cover:true). Now it clears
   cover.jpg first and regenerates only if there's a valid source.

Verified live against a booted sidecar: cover carries no-cache + ETag, a
matching If-None-Match → 304, and deleting the source folder.jpg drops the
cached cover (404, meta.cover cleared, manifest cover:false).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/api/music/router.ts

@@ -41,6 +41,10 @@ musicRouter.all('/*', async (ctx) => {
   if (range) headers['Range'] = range;
   const contentType = ctx.req.header('content-type');
   if (contentType) headers['Content-Type'] = contentType;
+  // Forward conditional-request headers so the sidecar's ETag(=v) revalidation works: a `no-cache`
+  // artifact (cover/meta/…) gets a cheap 304 when unchanged, a fresh 200 when its version changed.
+  const inm = ctx.req.header('if-none-match');
+  if (inm) headers['If-None-Match'] = inm;
   // Forward the authenticated user id so the sidecar can serve its per-user state routes (favorites /
   // now-playing / playlists). The sidecar binds loopback only, so this header is trusted.
   headers['X-Officer-User'] = String(ctx.get('user').id);