feat: release payload disk cache, batched rip status for list, artwork 404, stricter input handling

server/test/lookup.test.ts

@@ -126,6 +126,34 @@ describe('GET /api/lookup/release/:id', () => {
     await app.close()
   })
 
+  it('caches release payloads on disk (second lookup costs no discogs call)', async () => {
+    let releaseCalls = 0
+    const { app, cookie } = await appWithToken(
+      stubFetch((url) => {
+        if (url.includes('/releases/1001')) {
+          releaseCalls++
+          return new Response(JSON.stringify(discogsReleaseFixture), {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
+          })
+        }
+        return new Response('nope', { status: 404 })
+      })
+    )
+    await app.inject({ method: 'GET', url: '/api/lookup/release/1001', ...auth(cookie) })
+    await app.inject({ method: 'GET', url: '/api/lookup/release/1001', ...auth(cookie) })
+    expect(releaseCalls).toBe(1)
+    await app.close()
+  })
+
+  it('rejects non-integer release ids with 400', async () => {
+    const { app, cookie } = await appWithToken(discogsStub())
+    const res = await app.inject({ method: 'GET', url: '/api/lookup/release/abc', ...auth(cookie) })
+    expect(res.statusCode).toBe(400)
+    expect(res.json()).toEqual({ error: 'invalid_input' })
+    await app.close()
+  })
+
   it('reports duplicate when release already in collection', async () => {
     const { app, cookie } = await appWithToken(discogsStub())
     await app.inject({ method: 'POST', url: '/api/collection', ...auth(cookie), payload: { releaseId: 1001 } })