mpris: publish the audible deck on the D-Bus session bus

[vynulldev]

What & why

The Linux desktop already has now-playing surfaces everywhere - GNOME/KDE media controls and lock screens, playerctl, waybar/polybar modules, KDE Connect's phone mirroring - and they all speak MPRIS. Vynull now claims org.mpris.MediaPlayer2.vynull and mirrors the audible deck: the same deck selection /api/nowplaying already makes for the OBS overlay, exposed in-process through a new NowPlayingSnapshot method and polled once a second. Published: title, artist, track length, playhead position estimated from the deck's beat counter, and cover art via the existing artwork endpoint URL (MPRIS clients fetch artUrl themselves, so external tracks' fetched art works too).

Vynull observes decks rather than controlling them, so the player is deliberately read-only, which the MPRIS spec supports: every capability (CanPlay, CanPause, CanControl, ...) is false and the control methods are answered as no-ops. Well-behaved clients render metadata without transport controls. On by default; --mpris=false opts out, and a missing session bus (headless/systemd boxes) is a single debug log line, never a startup failure.

Two bugs the integration test caught before any human would have, both now documented in the code. Setting PlaybackStatus before Metadata let clients that react to the status change read the previous track's metadata; metadata now lands first. And godbus's prop package merges map-valued properties on store and never deletes keys (verified in the library source: dbus.Store into the existing map), so a shrinking metadata dict left the old track's title behind after a deck stopped; the dict now always carries the same key set so every update is a full overwrite.

This adds the first new dependency in a while: godbus/dbus/v5, the standard pure-Go D-Bus library, fetched over Tor. The test suite spins a private dbus-daemon per run (never touching the developer's bus) and drives the full surface with a real D-Bus client: name claim, identity, read-only capabilities, the stopped/playing/stopped lifecycle with full metadata assertions, no-op control calls answering without error, and the clean no-bus error path.

Not verified here: the actual desktop rendering (lock screen, playerctl, KDE Connect) needs a real session with a deck playing - a one-time playerctl -p vynull metadata against a live instance covers it.

Hardware testing

• Tested on: N/A: no deck-facing change. The publisher only reads the same monitor state the web UI polls; nothing on the Pro DJ Link side is touched.

Checklist

• go build ./..., go vet ./..., and go test ./... pass
• gofmt -l . is clean
• New source files carry an SPDX header (GPL-3.0-or-later)
• Tested on real hardware (deck + firmware noted above), or this change doesn't affect deck behaviour
• I agree my contribution is licensed under the project's GPLv3