stream: fallback only replays already-aired tracks

The fallback played the whole /cache directory, which at cold start holds
only the 2-3 tracks being pre-fetched — so it looped them until the
request.dynamic buffer filled. Restrict the fallback to tracks already
aired: the ingest daemon exposes them at GET /fallback.m3u (played_at set,
still on disk), and the stream fetches that into a local /tmp/fallback.m3u
that playlist watches. Cold start is now silent (assumed) instead of a tight
loop, and a mid-stream drain degrades across the whole listening history.

A local file (not a remote playlist URL) is used to avoid Liquidsoap's http
resolver mis-sniffing the response as text/html; mime_type is forced so an
empty header-only m3u still parses.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -17,8 +17,8 @@ sharing a cache volume:
   next track over HTTP at `GET /next`. *(currently it only serves the cache
   directory; the download providers come in later milestones — see roadmap)*
 - **`stream`** (Liquidsoap) — deliberately dumb. It pulls the next track from
-  the `ingest` daemon, broadcasts the audio over HTTP, and never goes silent
-  thanks to a local cache fallback.
+  the `ingest` daemon, broadcasts the audio over HTTP, and falls back to the
+  already-aired tracks (via `/fallback.m3u`) if the daemon has nothing ready.
 
 Playback sources (planned): a [Navidrome](https://www.navidrome.org/) library
 via the OpenSubsonic API, arbitrary tracks fetched with
@@ -89,9 +89,13 @@ Open the player at `http://localhost:8000/` — a small web page with an
   `/nowplaying` (JSON), fed from the broadcast source's live metadata — so it
   is accurate even though the ingest daemon runs a track ahead (prefetch).
 - A 3 s crossfade smooths transitions between tracks.
-- The fallback playlist now ignores non-audio and hidden files (`.gitkeep`,
-  in-progress `.part`), so the earlier startup ffmpeg "Invalid data" warnings
-  are gone.
+- The fallback only replays tracks **already aired**: the ingest daemon exposes
+  them as an `/fallback.m3u` playlist (served into a local file the stream
+  watches). The pre-fetch buffer (downloaded but not-yet-played tracks) is
+  excluded, so at cold start the list is empty and the stream stays **silent**
+  rather than looping the two or three tracks being pre-fetched. Once the buffer
+  drains mid-stream, it degrades gracefully across every track heard so far
+  instead of a tight loop.
 - Robustness: the ingest daemon shuts down cleanly on SIGTERM (fast
   `docker compose down`), has a Docker healthcheck on `/healthz` (the stream
   waits for it to be healthy), and outgoing HTTP calls retry transient