Run the web UI entirely in the browser

The FastAPI backend kept one analysis session shared by every visitor and
spooled each upload to the server's /tmp, and the browser copied audio into
persistent OPFS storage. None of that fits a tool for unreleased masters, so
the web UI is now a static site that decodes and analyses in the tab:

- web/decode.js: WAV/AIFF PCM and float read directly with libsndfile's
  scaling (bit-identical to librosa.load; Chromium's WAV decoder scales
  positive int16 by 1/32767), other formats via decodeAudioData on an
  OfflineAudioContext at the header-sniffed native rate. ID3 song names.
- web/dsp.js: ports of every Metric.compute with the same numerics
  (pyloudnorm K-weighting via lfilter's DF2T recurrence, BS.1770 gating,
  EBU LRA, resample_poly's Kaiser filter for true peak, librosa.stft and
  amplitude_to_db), streaming passes with no signal-length intermediates.
- web/metrics.js: build_spec ports producing the existing plot payload.
- web/analysis-worker.js + app.js: per-tab track list and result cache, a
  worker job queue where the visible metric jumps background prefetch, and
  the renderer, which now also draws the metrics' own reference lines.

Deployment is nginx-unprivileged serving web/ read-only with
Content-Security-Policy connect-src 'none', so the page cannot make network
requests at all, and no access log. No secure context is needed, so plain
http on a LAN works. The Python web backend, its smoke test, the web extra
and the OPFS store are removed; the desktop app is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015UXA39Sh9coAx4FhRkd8R2

docker-compose.yml

@@ -1,88 +1,37 @@
 # uj-mastering-master — web UI, container deployment template.
 #
-#   docker compose up --build        # build and start
-#   docker compose logs -f           # watch startup
-#   open http://localhost:8000
+#   docker compose up -d --build
+#   open http://localhost:8080
 #
-# There is deliberately no audio volume. Uploaded audio lives in the browser
-# (Origin Private File System) and each request body is spooled to /tmp only
-# while that request is being decoded. Nothing about a user's masters is
-# persisted here — read-only storage is not just possible, it is the intent.
+# The container serves static files only. Audio is decoded and analysed inside
+# the visitor's browser tab and never sent anywhere (the page's CSP forbids
+# network requests), so there is nothing to upload, persist or log here — and no
+# volumes, on purpose.
 
 services:
   ujm-web:
-    build:
-      context: .
-      dockerfile: Dockerfile
-      # Pin the build to this branch's source; override to build from a
-      # release tag instead:
-      #   docker compose build --build-arg ...
+    build: .
     image: uj-mastering-master-web:local
     container_name: ujm-web
 
-    # Loopback-only by default. The app binds 0.0.0.0 *inside* the container,
-    # but publishing to 127.0.0.1 means it is only reachable from this host —
-    # an analysis tool with no authentication should not appear on the LAN by
-    # accident. Change to "8000:8000" (or put it behind a reverse proxy) to
-    # expose it deliberately.
     ports:
-      - "127.0.0.1:8000:8000"
+      - "8080:8080"
 
-    environment:
-      # Analysis is CPU-bound numpy/scipy; keep BLAS from oversubscribing when
-      # several requests overlap. Raise these if you raise `cpus` below.
-      OMP_NUM_THREADS: "4"
-      OPENBLAS_NUM_THREADS: "4"
-      MKL_NUM_THREADS: "4"
-      NUMEXPR_NUM_THREADS: "4"
-      # Writable scratch for numba/matplotlib caches and request spools.
-      NUMBA_CACHE_DIR: /tmp/numba-cache
-      MPLCONFIGDIR: /tmp/matplotlib
-      TMPDIR: /tmp
-
-    # The container filesystem can be read-only: the app writes nothing it
-    # needs to keep. /tmp is a tmpfs (memory-backed) so spooled request bodies
-    # never touch a disk at all.
+    # Nothing to write: nginx only needs somewhere for its pid file and empty
+    # temp directories.
     read_only: true
     tmpfs:
-      - /tmp:size=1g,mode=1777
+      - /tmp:size=16m,mode=1777
 
-    # Analysis needs headroom: a long master at native sample rate is heavy in
-    # RAM. Raise the limit for large files; the tmpfs above is also backed by
-    # memory, so --memory must comfortably exceed it.
-    deploy:
-      resources:
-        limits:
-          cpus: "4.0"
-          memory: 4g
-
-    # Run as the image's unprivileged user (uid 10001). Nothing here needs root.
     security_opt:
       - no-new-privileges:true
     cap_drop:
       - ALL
 
     restart: unless-stopped
-    stop_grace_period: 10s
-
-    # The image ships a HEALTHCHECK; this is the same check expressed at the
-    # orchestration layer, so `docker compose ps` shows real health.
-    healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/metrics', timeout=4).status == 200 else 1)"]
-      interval: 30s
-      timeout: 5s
-      start_period: 20s
-      retries: 3
 
     logging:
       driver: json-file
       options:
-        max-size: "10m"
-        max-file: "3"
-
-# No volumes are declared, on purpose. If you want to run the API smoke test
-# inside the image, do it ad hoc rather than mounting a source tree:
-#
-#   docker compose exec ujm-web python - <<'PY'
-#   ...                        # or see `make smoke` in the README
-#   PY
+        max-size: "1m"
+        max-file: "2"