feat: media player API, web player panel, and Hope music MCP

- web/media_server.py: FastAPI service owning the permanent library
  (library.json + ./media volume), yt-dlp YouTube Music search, queued
  download jobs with mp3 transcode (ffmpeg), per-room player desired
  state, and an HTTPS proxy for external live-stream URLs.
- agent/media_mcp.py: Hope tools — search_music, play_song,
  offer_song_choices, pause/resume/stop/skip/seek, now_playing,
  list_library, add_stream.
- agent/agent.py: media toolset wiring + conversation rule (music
  playing disables the agent mic; re-engaging pauses music).
- web UI: slide-out Music panel (search, suggestions, library, live
  stream add, play/pause, ±10s, seek, volume) with a reconciling poller
  and media_state data-channel reports.
- token server returns the minted room name; nginx serves /media/files
  as static (native Range) and proxies /media/api to the media server.
- supervisord runs media-server; compose mounts ./media and adds
  ffmpeg to the image.

nginx.conf

@@ -23,6 +23,26 @@ server {
         proxy_send_timeout 3600s;
     }
 
+    # Media server API (library, search, player state) and the proxy for
+    # external live-stream URLs (http:// sources would be blocked as mixed
+    # content in the browser, so they are re-served over HTTPS from here).
+    location /media/api/ {
+        proxy_pass http://127.0.0.1:8092/media/api/;
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+
+    # Downloaded tracks are plain static files — nginx serves them with
+    # native HTTP Range support, which gives the web player seeking for free.
+    location /media/files/ {
+        alias /data/media/files/;
+    }
+
+    location /media/thumbs/ {
+        alias /data/media/thumbs/;
+    }
+
     location / {
         try_files $uri $uri/ =404;
     }