feat(p12-w2): track-cardinal high-res waveform fetch + bridge rewire

Add GET api/track/{trackEntryKey}/waveform/high-res (+ proxy), ITrackDataService.GetTrackWaveform; rewire visualizer to resolve the current track's EntryKey and re-fetch on track change. Retire the client mix-waveform read path.

DeepDrftAPI/Controllers/ReleaseController.cs

@@ -67,12 +67,17 @@ public class ReleaseController : ControllerBase
     }
 
     // GET api/release/{entryKey}/mix/waveform (unauthenticated)
-    // Serves the high-res waveform datum for a Mix release as base64. Mirrors GET api/track/{id}/waveform
-    // but reads the Mix's track datum from the track-waveforms vault. 404 when the release is not a Mix,
-    // carries no waveform key,
-    // or no datum is stored. Public read — addresses by the opaque EntryKey, not the int PK (§3e). The
-    // {entryKey} string segment cannot collide with the ApiKey-gated POST {id:long}/mix/waveform (different
-    // verb + constraint). Declared before the shorter "{entryKey}" route for clarity.
+    // Serves the high-res waveform datum for a Mix release as base64, reading the Mix's track datum from
+    // the track-waveforms vault. 404 when the release is not a Mix, carries no waveform key, or no datum
+    // is stored. Public read — addresses by the opaque EntryKey, not the int PK (§3e). The {entryKey}
+    // string segment cannot collide with the ApiKey-gated POST {id:long}/mix/waveform (different verb +
+    // constraint). Declared before the shorter "{entryKey}" route for clarity.
+    //
+    // LEGACY (phase-12 §5b): the visualizer no longer fetches through this release-addressed route — it
+    // resolves the current track's datum via the track-cardinal GET api/track/{trackEntryKey}/waveform/
+    // high-res. This endpoint is retained as a thin transitional delegate (it serves the identical datum,
+    // since a Mix is single-track) and has no client caller today; remove it once nothing depends on the
+    // release-addressed shape.
     [HttpGet("{entryKey}/mix/waveform")]
     public async Task<ActionResult> GetMixWaveform(string entryKey, CancellationToken ct = default)
     {

DeepDrftAPI/Controllers/TrackController.cs

@@ -577,6 +577,31 @@ public class TrackController : ControllerBase
         });
     }
 
+    // GET api/track/{trackId}/waveform/high-res (unauthenticated)
+    // Track-cardinal high-res datum fetch (phase-12 §5b): returns the per-track high-res waveform datum
+    // from the track-waveforms vault, base64-encoded, keyed by EntryKey. This is what the lava visualizer
+    // fetches for whatever track is currently playing/selected — the release is only addressing context.
+    // Distinct from GET {trackId}/waveform (the 512-bucket player-bar profile in the default vault): the
+    // "high-res" suffix selects the duration-derived TrackWaveforms datum. 404 when no high-res datum is
+    // stored (a track not yet backfilled — the visualizer blanks gracefully). Declared before the
+    // parameterized PUT "{trackId}" route so the literal "waveform/high-res" segment wins.
+    [HttpGet("{trackId}/waveform/high-res")]
+    public async Task<ActionResult> GetHighResWaveform(string trackId)
+    {
+        var bytes = await _waveformProfileService.GetProfileAsync(trackId, VaultConstants.TrackWaveforms);
+        if (bytes is null)
+        {
+            _logger.LogInformation("No high-res waveform datum for track: {TrackId}", trackId);
+            return NotFound();
+        }
+
+        return Ok(new WaveformProfileDto
+        {
+            BucketCount = bytes.Length,
+            Data = Convert.ToBase64String(bytes),
+        });
+    }
+
     // POST api/track/{trackId}/waveform ([ApiKeyAuthorize])
     // Admin backfill: compute and store a waveform profile for an existing track from its vault
     // audio. trackId is the EntryKey. 404 when no audio is stored under that key; 500 when the