Build a Music Streaming Backend in Lovable

Implement the mint-signed-url Edge Function at supabase/functions/mint-signed-url/index.ts. This function is called by useAudioPlayer on every play.

The function should:
1. Read the Authorization header and get the caller's user ID via supabase.auth.getUser().
2. Query the tracks table for the requested track_id to get tier and audio_key.
3. If tracks.tier = 'premium': check profiles.subscription_status = 'active' for the caller. If not active, return 403 with {error: 'Premium subscription required'}.
4. Generate a presigned GET URL for the R2 object using the AWS S3 v4 signing library. Use: endpoint = Deno.env.get('R2_ENDPOINT'), region = 'auto', bucket = Deno.env.get('R2_BUCKET'), key = track.audio_key, expiresIn = 3600 (1 hour TTL — long enough for a 1-hour listening session without re-minting mid-track).
5. Return {signed_url, expires_at}.

Use the aws4 signing package via esm.sh: import { SignatureV4 } from 'https://esm.sh/@aws-sdk/signature-v4@3'; import { Sha256 } from 'https://esm.sh/@aws-crypto/sha256-js@3'. Or use @aws-sdk/s3-request-presigner with @aws-sdk/client-s3 (also available via esm.sh).

In useAudioPlayer.ts, replace the stub URL fetch with a real call to this Edge Function. On play(track), call the function, set audio.src = signed_url, then call audio.play().

Also ensure all R2 credentials are in Cloud tab → Secrets: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, R2_ENDPOINT, R2_BUCKET.

Implement the upload-track Edge Function at supabase/functions/upload-track/index.ts.

The function should accept a multipart/form-data request with fields: audio_file (binary), title (string), album (string, optional), tier ('free' or 'premium'), cover_art_file (binary, optional).

The function should:
1. Verify the caller has role 'artist' (read from JWT app_metadata).
2. Generate a unique audio_key: `tracks/${auth.uid()}/${Date.now()}_${filename}`.
3. Upload the audio file to R2 via S3 PutObject using the same AWS credentials from Secrets.
4. If cover_art_file is present, upload it to Supabase Storage bucket 'cover-art' and get the storage path.
5. INSERT into tracks (artist_id, title, album, audio_key, audio_storage_provider='r2', tier, cover_art_path) and return the new track_id.

In UploadDropzone.tsx, replace the stub call with a real fetch to this Edge Function. Show upload progress (use XMLHttpRequest or the Fetch API's ReadableStream to track bytes sent). After upload completes, show a success toast with the track title and navigate to /track/:new_id.

Add a Stripe premium subscription tier. Use STRIPE_SECRET_KEY from Cloud Secrets (add it via the API Key icon in chat, or directly in Cloud tab → Secrets — never paste it in a chat message).

Create two Edge Functions:

1. `create-checkout-session` — accepts {price_id} in the body. Reads the caller's profiles.stripe_customer_id (call ensure-stripe-customer if null). Creates a Stripe Checkout Session with mode='subscription', the price_id, success_url='/account?session_id={CHECKOUT_SESSION_ID}', cancel_url='/account'. Returns {checkout_url}. React redirects to checkout_url.

2. `stripe-webhook` — reads raw body with `const rawBody = await req.text()` (NOT req.json()), gets the stripe-signature header, calls `await stripe.webhooks.constructEventAsync(rawBody, sig, Deno.env.get('STRIPE_WEBHOOK_SECRET'))`. On customer.subscription.updated: update profiles.subscription_status from the subscription status field. On customer.subscription.deleted: set profiles.subscription_status = 'canceled'. Return 200 immediately (Stripe retries on >5s response).

In /account, add a PricingSection with a single 'Go Premium' card showing the monthly price and feature list. The CTA button calls create-checkout-session. Show current subscription_status with a badge. Add a 'Manage subscription' button that calls a customer-portal Edge Function returning a Stripe portal URL.

Create a Stripe Product and Price in your Stripe Dashboard first (e.g. $9/mo for Premium catalog access). Note the price_id (price_xxx) and set it as a constant in the create-checkout-session function or in Cloud Secrets as STRIPE_PRICE_ID.

Implement the record-play Edge Function at supabase/functions/record-play/index.ts. The function accepts {track_id, duration_played_s, completed: boolean} in the body. It inserts a row into the plays table. The on_play_insert trigger bumps tracks.play_count automatically.

In useAudioPlayer.ts, call record-play in two places:
1. When the audio 'ended' event fires (completed=true, duration_played_s=duration).
2. When the user skips after playing more than 30 seconds (completed=false, duration_played_s=currentTime).

Create an /admin/insights page (gated by has_role('admin')). Show:
- Top 10 tracks by play_count this week (query plays joined to tracks, group by track_id, last 7 days).
- Unique listeners today vs yesterday (KPI card).
- Free vs premium play split pie chart (Recharts PieChart).
- A line chart of daily play_count totals for the last 30 days (Recharts LineChart).

Add 'Insights' to the admin sidebar section in AppLayout.

Add two playlist UX features:

1. Drag-to-reorder on /playlist/:id — install dnd-kit: import { DndContext, closestCenter } from '@dnd-kit/core' and { SortableContext, verticalListSortingStrategy, useSortable } from '@dnd-kit/sortable'. Wrap the track list in DndContext + SortableContext. On drag end, update all affected playlist_tracks.position values in a single Supabase upsert.

2. Add-to-playlist Sheet on every TrackRow — clicking the + icon opens a shadcn Sheet from the right. The Sheet lists the user's playlists (query playlists where owner_id = auth.uid()). Clicking a playlist inserts into playlist_tracks with position = (SELECT COALESCE(MAX(position), 0) + 1 FROM playlist_tracks WHERE playlist_id = ?). Show a success toast: 'Added to [playlist name]'. If the track is already in the playlist (UNIQUE constraint violation), show 'Already in this playlist'.

If you allow third-party artist uploads, you legally need a DMCA takedown workflow. Add:

1. A `takedown_requests` table: id (uuid pk), track_id (uuid references tracks(id)), reporter_email (text not null), reason (text not null), status (text default 'pending' check in ('pending','upheld','dismissed')), created_at (timestamptz default now()). RLS: INSERT for anyone (public — reporters don't need to be logged in); SELECT/UPDATE for admin only.

2. A 'Report track' button on /track/:id that opens a Dialog with a reason text area and submits to takedown_requests. No login required.

3. An /admin/takedowns page (admin-only) listing pending requests with uphold/dismiss buttons. On uphold: set tracks.tier = 'free' (or add a is_removed bool column and filter it out of all queries). Send a Resend email to the artist's email notifying them of the takedown.

This is not optional if you allow uploads from third parties — implement it before your first public-facing launch.