fix(v3.2.0): repair broken JSON API, add media sync endpoint, close open redirect

[JHNY5]

Scope note

These fixes target the v3.2.0 release line (the currently published stable image). Upstream master has since rewritten the API (moved to top-level routes), so several of these are already fixed by the rewrite — but the v3.2.0 tag has no branch, so this PR is opened against master for visibility and should be backported / cherry-picked onto the v3.2.0 release (or the release branch the maintainers use).

Problems fixed (all verified live against the shipped v3.2.0 image)

1. GET /api/v1/songs returns 500 — the collection endpoint has no route action and no template (only show exists). Any client following the documented API cannot list the library. Added index route + action + index.json.jbuilder.
2. API errors are masked as generic 500s — ErrorsController only has HTML templates; a JSON request hitting an error path fails to render errors/not_found as JSON and returns a broken 500. Added JSON responses so API consumers get structured {type, message} errors.
3. No API media-sync endpoint — POST /media_syncing is web-only (CSRF-bound); mobile/API clients cannot trigger a scan. Added POST /api/v1/media_syncing.
4. Open redirect — redirect_back_with_referer_params redirects to any referer_url param value; an on-page link with referer_url=https://evil.com can silently drop users onto an attacker domain. Now validates host (same-host or relative only).
5. Transcode-cache hardening (empty-file rejection + stale-cache eviction) — same as the separate master PR (covers v3.2.0 which shares the weakness).

Verification

All changes were live-tested against a patched v3.2.0 instance: songs index returns 200 JSON, media sync returns 202, errors return structured JSON (404 not 500), redirect stays on same host.