docs: reflect live home-hero stats (duration column, stats endpoint, backfill, NowPlayingStats wiring)

DeepDrftAPI/CLAUDE.md

@@ -110,6 +110,16 @@ Admin backfill view: returns every track with flags indicating whether each wave
 - **Response**: `List<WaveformStatusDto>` with `TrackId`, `EntryKey`, `TrackName`, `HasProfile` (bool — 512-bucket player-bar seeker profile in `waveform-profiles` vault), and `HasHighRes` (bool — duration-derived high-res visualizer datum in `track-waveforms` vault).
 - Returns 200 on success. Returns 500 on query error.
 
+### POST api/track/duration/backfill ([ApiKeyAuthorize])
+
+Admin backfill: for every track whose `DurationSeconds` SQL column is still null, reads the `AudioBinary.Duration` from the vault and writes it to SQL. Idempotent — a re-run only touches still-null rows; rows that already have a value are skipped.
+
+- **Header `ApiKey`**: required. Validated by `ApiKeyAuthenticationMiddleware`.
+- No request body.
+- Calls `UnifiedTrackService.BackfillDurationsAsync`. Lives on `TrackController` in the literal-route block (before `{trackId}` routes, so the segment is never treated as a trackId).
+- **Response**: `{ updated: int, skipped: int }` — counts of rows written vs. already-populated rows bypassed.
+- Returns 200 on success. Returns 500 if the backfill operation fails.
+
 ### DELETE api/track/release/{id:long} ([ApiKeyAuthorize])
 
 Soft-delete a release row. Used by the albums browser to remove an orphaned release (one with no live tracks).
@@ -272,6 +282,20 @@ Stores a hero image in the `images` vault and links it via `SessionMetadata.Hero
 - Validates MIME type (rejects unsupported types with `.bin` sentinel). Calls `UnifiedReleaseService.SetHeroImageAsync`.
 - Returns 200 on success. Returns 400 for missing file or unsupported MIME type. Returns 404 if release not found. Returns 500 on processing or vault failure.
 
+## The stats endpoints
+
+### GET api/stats/home (unauthenticated)
+
+Aggregate figures behind the public home hero stat row (`NowPlayingStats`). A single read returns everything the three cards need so the client makes one round-trip. Public, same auth posture as `GET api/track/page`.
+
+- **Response**: `HomeStatsDto` with:
+  - `CutTrackCount` (int): total non-deleted tracks on Cut-medium releases.
+  - `CutReleaseTypeCounts` (`List<CutReleaseTypeCount>`): per-`ReleaseType` Cut release counts; zero-count types are absent (zero-suppressed server-side).
+  - `MixReleaseCount` (int): total non-deleted Mix-medium releases.
+  - `MixRuntimeSeconds` (double): sum of `DurationSeconds` across all non-deleted tracks on Mix releases (null durations count as 0).
+- Aggregated in `TrackRepository.GetHomeStatsAsync`, surfaced via `ITrackService`/`TrackManager`. Controller is `StatsController` — a thin HTTP boundary; no domain logic lives there.
+- Returns 200 on success. Returns 500 on query error.
+
 ## ApiKey middleware behaviour
 
 `ApiKeyAuthenticationMiddleware` runs on every request but only enforces on endpoints with `[ApiKeyAuthorize]` metadata.