fix(align): review round 1 for the alignment page

- server: collapse leading slashes so //host/x is never proxied off-host
  or redirected cross-origin; 1 MB body limit; max 10k anchors; a corrupt
  alignment.json no longer 500s /api/songs (song falls back to auto with
  a warning); comments on cookie scope and the loopback inner server
- warp (ruling A6): adding/moving a manual anchor removes autos only
  within 10 s (MIDI) of the new/old position, never past a manual, plus
  any auto that would break audio monotonicity
- page: first anchor clamped at >= 0 s; ruler scrubbing seeks on release;
  wording for the new auto-removal rule; removed-count excludes the
  dragged anchor; shows server warnings
- manifest: unique tmp name for alignment.json; clear error for a
  corrupt file
- resample test: speed asserted as a ratio to the direct path

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/dsp/resample.test.ts

@@ -23,13 +23,15 @@ function reference(x: Float32Array, from: number, to: number): Float32Array {
 
 const noise = (n: number) => { let s = 1; return Float32Array.from({ length: n }, () => ((s = (s * 16807) % 2147483647) / 2147483647) * 2 - 1); };
 
-test("2:1 decimation is bit-identical to the direct evaluation and fast", () => {
+test("2:1 decimation is bit-identical to the direct evaluation and much faster", () => {
   const x = noise(44100);
   expect(Array.from(resample(x, 44100, 22050))).toEqual(Array.from(reference(x, 44100, 22050)));
-  const big = noise(44100 * 60);
-  const t0 = performance.now();
-  resample(big, 44100, 22050);
-  expect(performance.now() - t0).toBeLessThan(500); // one minute of audio: ~50 ms cached vs ~1.7 s direct
+  const big = noise(44100 * 10);
+  const time = (f: () => unknown) => { const t0 = performance.now(); f(); return performance.now() - t0; };
+  time(() => resample(big, 44100, 22050)); // warm-up (JIT)
+  const fast = time(() => resample(big, 44100, 22050)), slow = time(() => reference(big, 44100, 22050));
+  // measured ~40x; a 4x margin keeps this robust on a loaded machine
+  expect(fast * 4).toBeLessThan(slow);
 });
 
 test("non-integer ratios are unchanged", () => {