chore: sloppyslop working state — bump submodules + env/ignore/CLAUDE docs

Point mcma-backend + mcma-webui at their sloppyslop tips (lyrics, transcoding,
admin/storage/maintenance/instance UI, batch metadata, NowPlaying+lyrics).
Includes the CORS note in .env.example, TODO/ ignore, and the project CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -35,6 +35,11 @@ REFRESH_TOKEN_TTL_SECONDS=2592000
 # Public self-service sign-up (POST /auth/register). Set to false to make
 # accounts admin-only. Backend authority; pair with PUBLIC_ENABLE_REGISTRATION.
 ALLOW_REGISTRATION=true
+# CORS: browser origins allowed to call the API. Defaults to "*" (safe here —
+# auth is a bearer token, not cookies). The web UI can connect cross-origin
+# (e.g. the direct :8000 port, a LAN IP), which needs this. Restrict in
+# hardened setups: CORS_ALLOW_ORIGINS=http://localhost:8881,http://localhost:3000
+# CORS_ALLOW_ORIGINS=*
 
 # media / storage (paths inside the container)
 MEDIA_PATH=/data/media