feat: app shell with sidebar + bug fixes

UI:
- Add persistent sidebar (210px) with band switcher dropdown, Library/Player/Settings nav, user avatar row, and sign-out button
- Align design system CSS vars to CLAUDE.md spec (#0f0f12 bg, #e8a22a amber accent, rgba borders/text)
- Remove light mode toggle (no light mode in v1)
- Homepage auto-redirects to first band; shows create-band form only when no bands exist
- Strip full-page wrappers from all pages (shell owns layout)
- Remove debug console.log statements from SongPage

Bug fixes:
- nginx: trailing slash on `location ^~ /api/v1/bands/` caused 301 redirect on POST, dropping the request body — removed trailing slash
- API: _member_from_request (used by nc-scan stream) only accepted Bearer token, not httpOnly cookie — add rh_token cookie fallback
- API: internal_secret config field now has a dev default so the service starts without INTERNAL_SECRET env var set

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/nginx.conf

@@ -15,7 +15,9 @@ server {
 
     # Band routes — NC scan can take several minutes on large libraries.
     # ^~ prevents the static-asset regex below from matching /api/ paths.
-    location ^~ /api/v1/bands/ {
+    # Note: no trailing slash — nginx redirects /api/v1/bands → /api/v1/bands/
+    # with 301 if the location ends in /, which breaks POST requests.
+    location ^~ /api/v1/bands {
         proxy_pass http://api:8000;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;