Stop the admin panel hanging when slskd is down

/api/admin/system probed slskd with the shared client, whose 30s timeout is
sized for searches and transfers. So the panel sat on skeletons for the full
30s exactly when slskd was unreachable -- the case you open it to diagnose --
and the 5s UI poll stacked requests behind it. Probes now get 4s: above a LAN
round-trip, under the poll interval.

httpx.ConnectTimeout also stringifies to "", so the banner rendered
"slskd unreachable -- " with nothing after the dash. Fall back to the
exception class name.

Add dev.sh, because the documented dev commands could not work: MUSE_DB
defaults to /config/muse.db which a Mac cannot write, and the auth preflight
refuses to boot without a client ID.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -95,16 +95,39 @@ dedicated endpoint is the only source that carries `track_position` and
 ### Developing
 
 ```bash
-# terminal 1 — the API
-uvicorn app:app --port 5041
+./dev.sh            # http://127.0.0.1:5041
+```
 
-# terminal 2 — the UI, proxying /api and /auth to the above
+Creates the venv on first run, keeps its state in `dev/` (gitignored), and
+serves the prebuilt `web/out` exactly as the container does — same CSP, same
+routes, same middleware. Add `--build` after editing the UI.
+
+It sets **`MUSE_AUTH=off`**, so there is no OAuth app to register against a
+localhost callback. With auth off every role check reports `admin`, which is
+what keeps the admin panel reachable; the startup banner says so in capitals.
+
+What works with nothing else running: search, autocomplete, 30-second previews,
+album and artist pages, artwork-derived accent, the admin panel, and queueing.
+Requests reach `searching` and then fail, because acquisition needs slskd —
+point `SLSKD_URL`/`SLSKD_API_KEY` at a real instance to test that half.
+
+Two things read differently on a Mac. **CPU and memory show `—`**: those come
+from `/proc`, which is Linux-only, so they populate in the container and not
+here (load average and disk use `getloadavg`/`statvfs` and work everywhere).
+And the **`Users` count includes accounts you seed by hand** — with auth off
+nobody can sign in, so add them through the panel's Invite button or the API.
+
+For UI work, leave that running and start Next's dev server beside it:
+
+```bash
 cd web && npm install && npm run dev
 ```
 
-`next dev` serves on :3000 and rewrites `/api/*` and `/auth/*` to the FastAPI
-process, so the browser sees one origin and cookies behave exactly as they do
-in production. `npm run build` writes `web/out/`, which is what ships.
+`next dev` serves on :3000 with hot reload and rewrites `/api/*` and `/auth/*`
+to the FastAPI process, so the browser sees one origin and cookies behave
+exactly as they do in production. `npm run build` writes `web/out/`, which is
+what ships. Note that :3000 serves the UI without the CSP the Python process
+attaches — check anything CSP-sensitive on :5041 after a `--build`.
 
 ## Bulk import