v0.10.0

Added

• Recover My Uploads — stream diagnostics, safe import, retries & UI (increment 2). The recovery path now, after fetch+stage, runs read-only stream/manifest/DRM diagnostics on each item (inspect_stream_diagnostics: HLS/DASH/SABR/progressive classification, container/codec, and EME/key-system detection only), verifies audio integrity and identity (AcoustID + MusicBrainz, with a safe singleton fallback for genuinely-original uploads), and imports into the library through beets_adapter.run_import without ever overwriting an existing library item (staged-root-confined; paths outside staging are refused). Run state is persisted so failed/unrecovered URLs can be retried, and playlist coverage is refreshed after import. New endpoints GET /api/recover/runs, POST /api/recover/retry, and POST /api/recover/import join the increment-1 probe/enumerate/fetch routes, and a new Recover My Uploads panel surfaces per-item recovery states (Available / Authentication required / Unsupported format / DRM-protected / Provider unavailable / Download failed / Recovered / Verified / Imported). A DRM-protected state is shown only on real EME/DRM evidence, never inferred from a failed download. sanitize_diagnostic_report accepts an external/laboratory streaming diagnostic (e.g. from the Streaming Security Lab's opt-in exporter), strips every secret field (content keys, KIDs, PSSH/init-data, licenses, cookies, tokens, headers) by recursive allowlisting, and unconditionally reports decryption_supported=false / widevine_decryptable=false — a ClearKey laboratory observation never implies commercial Widevine decryptability, and no DRM is circumvented.