feat(api): report login methods and add GET /capabilities

api/openapi/components/schemas/Capabilities.yaml

@@ -0,0 +1,10 @@
+type: object
+description: |
+  Capability modules this server implements, keyed by module. Keys are optional; a missing key means the
+  module is not implemented. New modules are added as new optional keys. These are server facts, not what
+  the calling token may use.
+properties:
+  core:
+    $ref: ./CoreCapability.yaml
+  password:
+    $ref: ./PasswordCapability.yaml

api/openapi/components/schemas/CoreCapability.yaml

@@ -0,0 +1,5 @@
+type: object
+description: The mandatory core module.
+required: [version]
+properties:
+  version: {type: integer, description: Module version. Bumped only on semantic change.}

api/openapi/components/schemas/LoginMethods.yaml

@@ -0,0 +1,8 @@
+type: object
+description: |
+  Login methods this server accepts, keyed by method. A missing key means the method is not offered.
+  Keys are optional on purpose: discovery is read by clients of any version against servers of any
+  version, so new methods are added as new optional keys. Clients ignore keys they do not know.
+properties:
+  password:
+    $ref: ./PasswordLoginMethod.yaml

api/openapi/components/schemas/PasswordCapability.yaml

@@ -0,0 +1,5 @@
+type: object
+description: The password login module (login, first-admin setup, password change).
+required: [version]
+properties:
+  version: {type: integer, description: Module version. Bumped only on semantic change.}

api/openapi/components/schemas/PasswordLoginMethod.yaml

@@ -0,0 +1,2 @@
+type: object
+description: Username and password login (`POST /auth/login`). No settings yet.

api/openapi/components/schemas/ServerInfo.yaml

@@ -15,8 +15,4 @@ properties:
     type: boolean
     description: True until the first admin user has been created.
   loginMethods:
-    type: array
-    description: Login methods this server accepts. New methods may be added; clients ignore values they do not recognise.
-    items:
-      type: string
-      enum: [password]
+    $ref: ./LoginMethods.yaml

api/openapi/openapi.yaml

@@ -4,7 +4,7 @@ info:
   version: 1.0.0
   description: |
     Navidrome API v1. Spec-first, additive within v1. Clients discover implemented
-    capability modules through `GET /server` and never sniff versions.
+    capability modules through `GET /capabilities` and never sniff versions.
 
     Enums are open: new values may be added to any enum within v1. Clients must
     accept values they do not recognise instead of failing.
@@ -32,6 +32,8 @@ tags:
 paths:
   /server:
     $ref: ./paths/server.yaml
+  /capabilities:
+    $ref: ./paths/capabilities.yaml
   /openapi.json:
     $ref: ./paths/openapi.yaml#/json
   /openapi.yaml:

api/openapi/paths/capabilities.yaml

@@ -0,0 +1,16 @@
+get:
+  operationId: getCapabilities
+  x-module: core
+  x-stability-level: alpha
+  tags: [server]
+  summary: List implemented capability modules
+  description: The capability modules this server implements. Any valid access token may read it, whatever its scopes.
+  security: [{bearerAuth: []}]
+  responses:
+    '200':
+      description: Implemented modules.
+      content:
+        application/json:
+          schema: {$ref: ../components/schemas/Capabilities.yaml}
+    '401': {$ref: ../components/responses/Unauthorized.yaml}
+    '500': {$ref: ../components/responses/InternalError.yaml}

api/openapi/paths/server.yaml

@@ -7,8 +7,7 @@ get:
   summary: Describe the server
   description: |
     Returns the public server description. No authentication required.
-    Authenticated requests will additionally receive the implemented capability modules
-    once authentication is available.
+    Capability modules are listed by `GET /capabilities`.
   responses:
     '200':
       description: Server description.