Phase 1.g — Public playlist SSG pages + SEO

[InstaZDLL]

Tracking issue for sub-phase 1.g of RFC-001.

Public, indexable surfaces for playlists and albums — the SEO play. Anyone with a link should land on a polished page without logging in, with proper OG metadata for social sharing.

Scope — waveflow-web

• /p/[slug] — public playlist page (SSG with ISR fallback, revalidate hourly).
• /album/[slug] — public album page (same shape).
• /artist/[slug] — public artist page (bio, top tracks, related artists if available from server).
• OG image generation (@vercel/og equivalent or custom): server-rendered PNG with cover, title, author.
• sitemap.xml enumerates all public playlists/albums/artists.
• robots.txt — allow indexing of public surfaces, disallow /dashboard, /auth/*.
• Meta tags per page: title, description, og:*, twitter:*, application/ld+json for MusicPlaylist / MusicAlbum.
• 30s preview clips available without login (server endpoint already supports this via 1.e + a ?preview=1 flag — add the flag in this sub-phase).

Scope — waveflow-server

• Per-entity "public" toggle: UPDATE playlist SET is_public = true WHERE id = ….
• Rate-limiting on public endpoints (configurable, default 60 req/min/IP).
• Slug generation: stable, URL-safe, collision-resistant ({slugified_title}-{base62(id)[:6]}).
• GET /public/playlists/:slug etc. — anonymous reads, no auth, only returns rows where is_public = true.

Acceptance criteria

• Public playlist URL renders the SSG page in <500ms TTFB.
• OG image embeds cleanly in Slack, Discord, Twitter.
• sitemap.xml is valid and lists only public entities.
• Lighthouse score ≥ 90 on Performance + SEO + Accessibility for the public surfaces.
• 30s preview clip plays on a logged-out browser.
• Search engines (Bing/Google) accept the sitemap (smoke-test via Search Console).
• Rate-limit returns 429 Too Many Requests with Retry-After header.

Dependencies

• Blocks on: 1.b (CRUD endpoints), 1.c (web scaffolding), 1.e (streaming for preview).

Estimate

~3 weeks.