feature: Embed Frame Player

DeepDrftAPI/Controllers/TrackController.cs

@@ -236,6 +236,28 @@ public class TrackController : ControllerBase
         return Ok(result.Value);
     }
 
+    // GET api/track/meta/by-key/{entryKey}: single track metadata by vault entry key.
+    // Unauthenticated, like GET api/track/page and GET api/track/{id} — reachable through the
+    // public proxy. 3-segment route, so no collision with meta/{id:long} or {trackId}.
+    [HttpGet("meta/by-key/{entryKey}")]
+    public async Task<ActionResult> GetMetaByKey(string entryKey)
+    {
+        var result = await _sqlTrackService.GetByEntryKey(entryKey);
+        if (!result.Success)
+        {
+            var error = result.Messages.FirstOrDefault()?.Message ?? "Unknown error";
+            _logger.LogError("GetMetaByKey failed for {EntryKey}: {Error}", entryKey, error);
+            return StatusCode(500, "Failed to load track");
+        }
+
+        if (result.Value is null)
+        {
+            return NotFound();
+        }
+
+        return Ok(result.Value);
+    }
+
     // PUT api/track/meta/{id}: metadata-only update. EntryKey is immutable and not part of the body.
     [ApiKeyAuthorize]
     [HttpPut("meta/{id:long}")]