feat(ui): finalize rehearsal console redesign

[seonghobae]

Summary

• Reworks the desktop workspace into a dark rehearsal console with sidebar navigation, source controls, rehearsal metrics, timeline, role board, and non-overclaiming stem/priorities copy.
• Adds sections[].timeRange as a strict shared contract across TypeScript, Python, and Rust, including fail-closed legacy project validation.
• Tightens YouTube URL intake before Tauri IPC and validates native YouTube metadata paths under the app-owned cache root.

Test Plan

• npm run test --workspace @bandscope/desktop -- App.test.tsx lib/analysis.test.ts lib/export.test.ts
• npm run test --workspace @bandscope/shared-types -- index.test.ts
• uv run pytest tests/test_api.py -q from services/analysis-engine
• uv run ruff check src tests from services/analysis-engine
• cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml --locked && cargo check --manifest-path apps/desktop/src-tauri/Cargo.toml --locked
• npm audit --workspaces --audit-level=high
• BANDSCOPE_ENABLE_RUST_CHECK=1 ./scripts/harness/quickcheck.sh
• Playwright smoke on http://127.0.0.1:5173: imported supported YouTube URL, started analysis, verified Rehearsal Console, verse · 0:10–0:30, and stem-lane pending copy; current-session console errors: none.

Security Notes

• Attack surface: YouTube URL intake, Tauri IPC, imported project files, app-owned cache metadata, and rendered remote/source metadata.
• Trust boundaries: URL and project payloads remain untrusted until schema/path validation succeeds; native metadata paths must canonicalize under the cache root and use supported audio extensions.
• Mitigations: duplicate/blank YouTube v params are rejected before IPC, legacy project sections without timeRange fail closed, timeRange values are bounded to the Rust u32 contract, and UI copy avoids presenting unavailable analysis as fact.
• Remaining risk: full YouTube downloader/network behavior still depends on the later import implementation and external provider behavior; this PR only tightens the current handoff and fallback contract.
• Test points: TS URL rejection, TS shared payload validation, Python bounds checks, Rust project/metadata validation, and local Playwright smoke.

PR continuity

• Current branch has no existing PR; PR feat: implement local ML stem separation with chunking #111 is a different head branch (feature/issue-106-stem-separation) and is not reused.
• Base is main because this branch was cut from the current release line; origin/develop...HEAD includes unrelated backlog/release divergence while origin/main...HEAD is the intended focused 13-file diff.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 993d7376-96c9-4e11-89be-81227b72ce9d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/rehearsal-console-redesign

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}