Run the web UI entirely in the browser

The FastAPI backend kept one analysis session shared by every visitor and
spooled each upload to the server's /tmp, and the browser copied audio into
persistent OPFS storage. None of that fits a tool for unreleased masters, so
the web UI is now a static site that decodes and analyses in the tab:

- web/decode.js: WAV/AIFF PCM and float read directly with libsndfile's
  scaling (bit-identical to librosa.load; Chromium's WAV decoder scales
  positive int16 by 1/32767), other formats via decodeAudioData on an
  OfflineAudioContext at the header-sniffed native rate. ID3 song names.
- web/dsp.js: ports of every Metric.compute with the same numerics
  (pyloudnorm K-weighting via lfilter's DF2T recurrence, BS.1770 gating,
  EBU LRA, resample_poly's Kaiser filter for true peak, librosa.stft and
  amplitude_to_db), streaming passes with no signal-length intermediates.
- web/metrics.js: build_spec ports producing the existing plot payload.
- web/analysis-worker.js + app.js: per-tab track list and result cache, a
  worker job queue where the visible metric jumps background prefetch, and
  the renderer, which now also draws the metrics' own reference lines.

Deployment is nginx-unprivileged serving web/ read-only with
Content-Security-Policy connect-src 'none', so the page cannot make network
requests at all, and no access log. No secure context is needed, so plain
http on a LAN works. The Python web backend, its smoke test, the web extra
and the OPFS store are removed; the desktop app is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015UXA39Sh9coAx4FhRkd8R2

pyproject.toml

@@ -7,12 +7,10 @@ name = "uj-mastering-master"
 version = "0.1.0"
 requires-python = ">=3.10"
 
-# Only what the *analysis* needs. The GUI stack lives in the `desktop` extra
-# below, because nothing on the web path touches it: `webapp.py`,
-# `web_session.py`, `metrics_json.py`, `master_core.py`, `metrics.py` and
-# `plotspec.py` import no Qt, no pyqtgraph and no matplotlib canvas. Keeping
-# PyQt5 here would force a `--headless`-style install to drag in a full Qt
-# stack it never loads.
+# What the *analysis* needs. The GUI stack lives in the `desktop` extra below.
+# The web UI (web/) is a static site that analyses audio in the browser and needs
+# none of these; `tests/parity` uses them to check the browser port against
+# `metrics.py`.
 dependencies = [
     "librosa",
     "numpy",
@@ -34,30 +32,16 @@ desktop = [
     "pyqtgraph>=0.14.0",
 ]
 
-# Web front end. Installed with:
-#   uv sync --extra web
-# Deliberately separate from the desktop path: a server install of the web UI
-# needs no Qt/wheel stack. Which is what makes the container image small and
-# lets it run without a display server at all.
-web = [
-    "fastapi>=0.110",
-    "uvicorn[standard]>=0.27",
-    "python-multipart>=0.0.9",   # multipart upload parsing for FastAPI
-]
-
 [tool.uv]
 # Note: `default-groups` cannot name an entry from `[project.optional-dependencies]`
 # — it only accepts `[dependency-groups]` names, and errors with "Default group
 # `desktop` ... is not defined in the project's `dependency-groups` table".
-# Extras must be requested explicitly, which is why the README spells out both:
-#   uv sync                    # analysis + nothing else
+# Extras must be requested explicitly:
+#   uv sync                    # analysis only
 #   uv sync --extra desktop    # + Qt/pyqtgraph (the GUI; `uv run ujm`)
-#   uv sync --extra web        # + fastapi/uvicorn (`uv run ujm-web`)
-#   uv sync --all-extras       # both
 
 [project.scripts]
 ujm = "main:main"
-ujm-web = "webapp:main"
 
 [tool.setuptools]
 py-modules = [
@@ -72,26 +56,4 @@ py-modules = [
     "ref_line_widget",
     "logger_setup",
     "setup_fonts",
-    # web front end
-    "webapp",
-    "web_session",
-    "metrics_json",
 ]
-# `static/` is declared a *package* so `package-data` has something to attach
-# to. `package-data` keys match packages, and top-level `py-modules` are not
-# packages — so the earlier `"*" = [...]` form silently matched nothing and the
-# built wheel contained no assets at all (verified: 14 .py files, zero HTML/
-# JS/CSS). An installed `ujm-web` therefore 404'd every asset. With this entry
-# the assets install to `site-packages/static/`, which is exactly where
-# `webapp.py` looks (`Path(__file__).parent / "static"`).
-packages = ["static"]
-
-[tool.setuptools.package-data]
-# Vendored browser assets: uPlot (curves), no CDN at runtime. Keyed on the
-# `static` package (declared above) rather than `"*"`: a `"*"` key matches
-# *packages*, and there are none besides `static` — the app modules are
-# top-level `py-modules`, which is why the original form shipped nothing.
-#
-# `**/*` rather than `*` so the glob reaches `static/vendor/`, where the uPlot
-# bundle lives.
-static = ["*", "**/*"]