Refactor storage to provider-agnostic band-scoped model

Replaces per-member Nextcloud credentials with a BandStorage model that
supports multiple providers. Credentials are Fernet-encrypted at rest;
worker receives audio via an internal streaming endpoint instead of
direct storage access.

- Add BandStorage DB model with partial unique index (one active per band)
- Add migrations 0007 (create band_storage) and 0008 (drop old nc columns)
- Add StorageFactory that builds the correct StorageClient from BandStorage
- Add storage router: connect/nextcloud, OAuth2 authorize/callback, list, disconnect
- Add Fernet encryption helpers in security/encryption.py
- Rewrite watcher for per-band polling via internal API config endpoint
- Update worker to stream audio from API instead of accessing storage directly
- Update frontend: new storage API in bands.ts, rewritten StorageSection,
  simplified band creation modal (no storage step)
- Add STORAGE_ENCRYPTION_KEY to all docker-compose files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

worker/Dockerfile

@@ -22,9 +22,29 @@ RUN --mount=type=bind,from=essentia-builder,source=/usr/local/lib,target=/essent
 
 RUN pip install uv
 
+FROM base AS development
+COPY pyproject.toml .
+RUN uv sync --all-extras --no-install-project --frozen || uv sync --all-extras --no-install-project
+ENV PYTHONPATH=/app/src
+ENV PYTHONUNBUFFERED=1
+ENV LOG_LEVEL=DEBUG
+CMD ["/bin/sh", "-c", "PYTHONPATH=/app/src exec /app/.venv/bin/watchfiles --ignore-permission-denied '/app/.venv/bin/python -m worker.main' src"]
+
 FROM base AS production
 COPY pyproject.toml .
 RUN uv sync --no-dev --frozen || uv sync --no-dev
 COPY . .
 ENV PYTHONPATH=/app/src
+
+# Pre-warm librosa/numba JIT cache and pooch downloads so they happen at build
+# time and are baked into the image rather than downloaded on every cold start.
+RUN uv run python -c "\
+import numpy as np; \
+import librosa; \
+_dummy = np.zeros(22050, dtype=np.float32); \
+librosa.beat.beat_track(y=_dummy, sr=22050); \
+librosa.feature.chroma_stft(y=_dummy, sr=22050); \
+print('librosa warmup done') \
+"
+
 CMD ["uv", "run", "python", "-m", "worker.main"]