Add the submission pipeline and the review loop

Steps 3 and 4 of the build order. A member can now upload a song, watch it
convert, publish it, and review what everyone else has published.

Pipeline:
- ffprobe reads tags synchronously at submit so prefill never races typing;
  ffmpeg converts to Opus in the background, two at a time
- ffmpeg succeeding is the validation — no container sniffing
- publish moves the file inside the transaction, so a song row and its .ogg
  appear together or neither does
- five submissions per rolling 24h, failures excluded

Reviews and the reveal rule:
- the queue is unreviewed songs only, oldest first, never your own
- other people's reviews and the average are withheld in the query, not the
  template — a hidden average is never sent
- 30 minutes to edit or delete your own review, enforced in the WHERE clause
- deleting the last review unlocks the song for its submitter again

The waiting page has one button: the metadata form autosaves after a pause in
typing, and Julkaise submits it and publishes in the same request, so nothing
is lost without JS.

Genres store an English code and render a Finnish label.

main.go

@@ -135,9 +135,24 @@ func (a *app) memberMux() *http.ServeMux {
 	mux.HandleFunc("POST /register", a.register)
 	mux.HandleFunc("POST /logout", a.logout)
 
-	mux.HandleFunc("GET /{$}", a.requireMember(func(w http.ResponseWriter, r *http.Request) {
-		a.render(w, r, http.StatusOK, "home.html", page{Title: "Jono"})
-	}))
+	mux.HandleFunc("GET /{$}", a.requireMember(a.queuePage))
+	mux.HandleFunc("GET /songs", a.requireMember(a.browsePage))
+	mux.HandleFunc("GET /songs/{id}", a.requireMember(a.songPage))
+	mux.HandleFunc("POST /songs/{id}", a.requireMember(a.editSong))
+	mux.HandleFunc("POST /songs/{id}/delete", a.requireMember(a.deleteSong))
+	mux.HandleFunc("GET /audio/{id}", a.requireMember(a.audio))
+
+	mux.HandleFunc("POST /songs/{id}/review", a.requireMember(a.createReview))
+	mux.HandleFunc("POST /reviews/{id}", a.requireMember(a.editReview))
+	mux.HandleFunc("POST /reviews/{id}/delete", a.requireMember(a.deleteReview))
+
+	mux.HandleFunc("GET /submit", a.requireMember(a.submitPage))
+	mux.HandleFunc("POST /submit", a.requireMember(a.submit))
+	mux.HandleFunc("GET /submit/{id}", a.requireMember(a.submissionPage))
+	mux.HandleFunc("GET /submit/{id}/status", a.requireMember(a.submissionStatus))
+	mux.HandleFunc("POST /submit/{id}", a.requireMember(a.saveSubmission))
+	mux.HandleFunc("POST /submit/{id}/publish", a.requireMember(a.publish))
+	mux.HandleFunc("POST /submit/{id}/discard", a.requireMember(a.discard))
 	return mux
 }