Run the web UI entirely in the browser

The FastAPI backend kept one analysis session shared by every visitor and
spooled each upload to the server's /tmp, and the browser copied audio into
persistent OPFS storage. None of that fits a tool for unreleased masters, so
the web UI is now a static site that decodes and analyses in the tab:

- web/decode.js: WAV/AIFF PCM and float read directly with libsndfile's
  scaling (bit-identical to librosa.load; Chromium's WAV decoder scales
  positive int16 by 1/32767), other formats via decodeAudioData on an
  OfflineAudioContext at the header-sniffed native rate. ID3 song names.
- web/dsp.js: ports of every Metric.compute with the same numerics
  (pyloudnorm K-weighting via lfilter's DF2T recurrence, BS.1770 gating,
  EBU LRA, resample_poly's Kaiser filter for true peak, librosa.stft and
  amplitude_to_db), streaming passes with no signal-length intermediates.
- web/metrics.js: build_spec ports producing the existing plot payload.
- web/analysis-worker.js + app.js: per-tab track list and result cache, a
  worker job queue where the visible metric jumps background prefetch, and
  the renderer, which now also draws the metrics' own reference lines.

Deployment is nginx-unprivileged serving web/ read-only with
Content-Security-Policy connect-src 'none', so the page cannot make network
requests at all, and no access log. No secure context is needed, so plain
http on a LAN works. The Python web backend, its smoke test, the web extra
and the OPFS store are removed; the desktop app is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015UXA39Sh9coAx4FhRkd8R2

web/analysis-worker.js

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// Analysis worker: the browser's AnalysisResultsManager worker thread.
+//
+// Holds each loaded track's mono signal (transferred in, never copied) and runs
+// one metric at a time on request, so a 10-minute spectrogram never blocks the
+// page. Everything stays in this tab's memory; closing the tab frees it.
+//
+// Messages in:  {type: 'load', trackId, mono, sampleRate}
+//               {type: 'compute', reqId, trackId, metricId}
+//               {type: 'drop', trackId}
+// Messages out: {type: 'result', reqId, trackId, metricId, data, ms}
+//               {type: 'error', reqId, trackId, metricId, message}
+
+import { COMPUTE, transferables } from './dsp.js';
+
+const tracks = new Map();   // trackId -> {mono, sampleRate, memo}
+
+self.onmessage = (event) => {
+  const msg = event.data;
+  if (msg.type === 'load') {
+    tracks.set(msg.trackId, { mono: msg.mono, sampleRate: msg.sampleRate, memo: {} });
+    return;
+  }
+  if (msg.type === 'drop') {
+    tracks.delete(msg.trackId);
+    return;
+  }
+  if (msg.type !== 'compute') return;
+
+  const { reqId, trackId, metricId } = msg;
+  const track = tracks.get(trackId);
+  const compute = COMPUTE[metricId];
+  if (!track || !compute) {
+    self.postMessage({
+      type: 'error', reqId, trackId, metricId,
+      message: track ? `unknown metric ${metricId}` : 'track is no longer loaded',
+    });
+    return;
+  }
+  try {
+    const t0 = performance.now();
+    const data = compute(track.mono, track.sampleRate, track.memo);
+    const ms = performance.now() - t0;
+    self.postMessage({ type: 'result', reqId, trackId, metricId, data, ms }, transferables(data));
+  } catch (err) {
+    self.postMessage({ type: 'error', reqId, trackId, metricId, message: String((err && err.message) || err) });
+  }
+};