Make album cover pictures mandatory, unify cover handling with playlists

Albums previously had no cover concept at all: no picture upload
flow, no GET /albums/{id}/cover, and AlbumApplicationResponse's
image-key fields were plumbed but never populated. Description,
Pictures and TrackCount already lived on the shared Album base entity
for both local and external albums, so unifying the cover story only
required building the missing local-album picture pipeline.

Backend, cloning PlayList's existing async picture-processing
architecture exactly (MassTransit routing slip + saga), but making
the picture mandatory instead of optional (matching Track's pattern):

- AlbumPictures moves from all-nullable to required fields.
- New AlbumConfiguration (routes/sizes), deliberately without
  PlayList's preset-picture fallback since a picture is now required
  up front.
- CreateAlbum now takes a mandatory PictureIntentId, validates and
  consumes the upload intent, and kicks off the same
  copy-to-final -> resize -> upload -> update-entity routing slip
  PlayLists use, via a new AlbumProcessingState saga that marks the
  album Failed on a picture-processing failure.
- UpdateAlbum takes an optional NewPictureIntentId to replace the
  cover later.
- New GET /albums/{id}/cover and POST /albums/upload-picture
  endpoints, mirroring the playlist ones.
- New EF migration for the AlbumProcessingState saga table.

Frontend:

- AlbumForm gains a cover dropzone, required on create and optional
  on edit (via ImageDropzone's new `required` prop), uploaded through
  the same presigned-upload helper playlists use.
- New /api/albums/{id}/cover proxy route.
- PlaylistArt gains a generic coverUrl prop so AlbumHeader and the
  album list/detail cards render the real uploaded cover instead of
  only the track mosaic fallback.

Delete-time picture cleanup for albums is intentionally left as a
follow-up, matching the existing gap in playlist deletion.

backend/Tests/Musify.Application.Tests/Albums/UpdateAlbumCommandHandlerTests.cs

@@ -1,13 +1,26 @@
 using ErrorOr;
 using Musify.Application.Albums;
+using Musify.Application.Contracts;
+using Musify.Application.Services;
 using Musify.Application.Tests.TestSupport;
+using NSubstitute;
 using Xunit;
 
 namespace Musify.Application.Tests.Albums
 {
     public sealed class UpdateAlbumCommandHandlerTests : HandlerTestBase
     {
-        private UpdateAlbumCommandHandler CreateHandler() => new(Database, NoOpLogger<UpdateAlbumCommandHandler>());
+        private readonly IEventBus eventBus = Substitute.For<IEventBus>();
+        private readonly IStorageService storageService = Substitute.For<IStorageService>();
+
+        private UpdateAlbumCommandHandler CreateHandler() => new(
+            eventBus,
+            Database,
+            new UploadIntentValidator(Database, storageService),
+            NoOpLogger<UpdateAlbumCommandHandler>(),
+            TestConfigurations.Storage(),
+            TestConfigurations.Album(),
+            TestConfigurations.UploadIntent());
 
         [Fact]
         public async Task Handle_Owner_UpdatesTitleDescriptionAndReleaseYear()
@@ -16,7 +29,7 @@ namespace Musify.Application.Tests.Albums
             var album = TestEntities.UserAlbum(owner.Id, title: "Old Title", description: "Old", releaseYear: 2020);
             await SeedAsync(owner, album);
 
-            var command = new UpdateAlbumCommand(owner.Id, album.Id, "  New Title  ", "New description", 2025);
+            var command = new UpdateAlbumCommand(owner.Id, album.Id, "  New Title  ", "New description", 2025, null);
 
             var result = await CreateHandler().Handle(command, TestContext.Current.CancellationToken);
 
@@ -30,10 +43,33 @@ namespace Musify.Application.Tests.Albums
             Assert.Equal("NEW TITLE", stored.NormalizedTitle);
         }
 
+        [Fact]
+        public async Task Handle_ValidPictureIntent_UpdatesPictureAndPublishesSourceEvent()
+        {
+            storageService
+                .HeadObjectAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<CancellationToken>())
+                .Returns(new ObjectMetaData("image/webp", 1024));
+
+            var owner = TestEntities.User();
+            var album = TestEntities.UserAlbum(owner.Id, title: "Old Title");
+            var intent = TestEntities.UploadIntent(owner.Id, Musify.Domain.ValueObjects.UploadIntentPurpose.AlbumPicture, objectName: "new-cover.webp");
+            await SeedAsync(owner, album, intent);
+
+            var command = new UpdateAlbumCommand(owner.Id, album.Id, "Old Title", null, null, intent.Id);
+
+            var result = await CreateHandler().Handle(command, TestContext.Current.CancellationToken);
+
+            Assert.False(result.IsError);
+            var stored = await Database.UserAlbums.FindAsync([album.Id], TestContext.Current.CancellationToken);
+            Assert.NotNull(stored);
+            Assert.Equal("new-cover.webp", stored.Pictures.OriginalName);
+            await eventBus.Received(1).PublishAsync(Arg.Any<Musify.Application.Events.UpdateAlbumPictureSourceEvent>(), Arg.Any<CancellationToken>());
+        }
+
         [Fact]
         public async Task Handle_AlbumMissing_ReturnsNotFound()
         {
-            var command = new UpdateAlbumCommand(1, Guid.NewGuid(), "Title", null, null);
+            var command = new UpdateAlbumCommand(1, Guid.NewGuid(), "Title", null, null, null);
 
             var result = await CreateHandler().Handle(command, TestContext.Current.CancellationToken);
 
@@ -48,7 +84,7 @@ namespace Musify.Application.Tests.Albums
             var album = TestEntities.UserAlbum(owner.Id);
             await SeedAsync(owner, stranger, album);
 
-            var command = new UpdateAlbumCommand(stranger.Id, album.Id, "Hijacked", null, null);
+            var command = new UpdateAlbumCommand(stranger.Id, album.Id, "Hijacked", null, null, null);
 
             var result = await CreateHandler().Handle(command, TestContext.Current.CancellationToken);