refactor(server): extract the media/file-serving routes into routers/media.py (R3)

[byrongamatos]

Song audio (/audio/{f}), the local-audio-path resolver (/api/audio-local-path), and raw sloppak-member serving (/api/sloppak/{f}/file/{rel}) — plus the shared _resolve_sloppak_local_file — → lib/routers/media.py.

Bodies verbatim except @app→@router and the cache/static path seams (AUDIO_CACHE_DIR→appstate.audio_cache_dir, STATIC_DIR→appstate.static_dir, SLOPPAK_CACHE_DIR→appstate.sloppak_cache_dir — all already in the seam). No new slots. The two test fixtures that redirect STATIC_DIR to a temp dir now also patch appstate.static_dir (the moved routes read the seam).

server.py: 2,638 → 2,507 (−131).

Verification

• pyflakes clean; route set identical (143), all unique-path (no catch-all, no shadowing).
• Full pytest 2395 passed (the audio-local-path + sloppak-file-traversal cases). npm run lint 0; Codex 0 findings.
• Boot smoke: /audio, /api/sloppak/{}/file serve 404 for unknown, 0 tracebacks.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added support for serving audio and media files from installed content packages.
  • Added a desktop-only endpoint for resolving local audio file paths.
  • Improved support for audio files served from configured cache and static locations.

• Bug Fixes

  • Strengthened path validation to prevent traversal and unsafe file access.
  • Added appropriate media types and clearer errors for missing or invalid files.

• Documentation

  • Updated release notes and server size-tracking documentation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a988af97-7e91-4245-ad7b-087379b6da35

📥 Commits

Reviewing files that changed from the base of the PR and between b7624b7 and f385fbd.

📒 Files selected for processing (6)

• CHANGELOG.md
• docs/size-exemptions.md
• lib/routers/media.py
• server.py
• tests/test_audio_local_path.py
• tests/test_sloppak_file_traversal.py

---

📝 Walkthrough

Walkthrough

Media and audio file-serving routes are extracted from server.py into lib/routers/media.py, mounted through the application router, and supported by updated filesystem fixtures and extraction documentation.

Changes

Media router extraction

Layer / File(s)	Summary
Media route implementation lib/routers/media.py	Adds containment-checked sloppak resolution, loopback-only local audio path resolution, and audio/sloppak file-serving endpoints.
Server router wiring server.py	Imports and mounts the media router and removes the corresponding inline handlers and unused import.
Validation and documentation tests/test_audio_local_path.py, tests/test_sloppak_file_traversal.py, CHANGELOG.md, docs/size-exemptions.md	Aligns test app state with temporary static paths and updates extraction and line-count records.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• got-feedBack/feedBack#824: Earlier refactor and extension of the same sloppak and local-file endpoints.
• got-feedBack/feedBack#843: Related DLC path-resolution and containment helper extraction.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: extracting media and file-serving routes from server.py into routers/media.py.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/r3-router-media

---

_{Comment @coderabbitai help to get the list of available commands.}