feat(tempo): surface tempo movement rehearsal cues

[seonghobae]

Summary

• Reuse the existing local temporal analyzer and tempo-stability detector to surface steady, loose, or variable tempo as a rehearsal cue.
• Map validated tempo movement into the shared rehearsal contract and display it in the workspace with English and Korean copy.
• Include the cue in chart-summary JSON exports without persisting raw audio paths or beat arrays.
• Invalidate pre-feature final-analysis caches while preserving reusable version-1 stem-feature caches.

Stack

This PR is intentionally based on fix/temporal-log-privacy and depends on BandScope PR #1055. It should merge after #1055 so the temporal analyzer path uses its privacy-safe logging behavior.

Verification

• PATH=/tmp/bandscope-tempo-stability-bin:$PATH ./scripts/harness/quickcheck.sh — passed with the repository-pinned npm 10.9.9.
• Python: 684 passed, 24 skipped, 100% coverage.
• Desktop: 218 tests passed with 100% configured coverage; shared-types tests passed.
• Typecheck, ESLint, Ruff, Bandit, mypy, documentation, security, supply-chain, GitHub bootstrap checks, and Vite build passed.
• git diff --check passed.
• Real local click-track probe: 120.2 BPM, 15 beats, steady, 0 tempo changes.

Security Notes

• Temporal analysis remains local-only; this adds no network, URL, subprocess, WebView, or IPC path.
• The existing validated local-audio request path is reused.
• Raw audio_path and beat_times are excluded from the feature/cache payload.
• Shared and API validation requires finite, positive tempo values and rejects malformed analysis by falling back without exposing a tempo cue.
• The final analysis cache uses schema version 2 so old results without tempo guidance are not reused; compatible stem-feature caches remain in their independent version-1 namespace.

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6b79afc0-01a7-4c43-897d-d14c2dbc4f23

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head local evidence for 11e6096:

• Real temporary click-track WAV through TemporalAnalyzer: 120.2 BPM, 15 beats, steady, 0 detected tempo changes.
• The raw source path was not included in the output or feature payload.

[devin-ai-integration]

Devin Review found 1 new potential issue.