Check the audio's length, since the filename can agree and still be wrong

The file that got filed as Michael Jackson's "Chicago" had every textual signal
in its favour: the title matched exactly, and once approved it landed under the
right artist, album and track number. The only thing that disagreed was the
running time -- 359 seconds against Deezer's 245 -- because it was The Fall.

Duration is the one signal a stranger's filename cannot fake, and muse already
had it: Deezer supplies it at request time and it has been sitting unused in the
jobs table. On import the real length is read off the downloaded audio and
compared; a drift past MUSE_LENGTH_TOLERANCE multiplies confidence down and
explains itself in the review queue rather than leaving a bare number.

For this case that is 0.75 -> 0.26, which falls below REVIEW_CONFIDENCE and so
reads as "almost certainly wrong" instead of "worth a look". It runs on import
rather than in confidence() because the file does not exist when the candidate
is chosen.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -308,6 +308,16 @@ filename alone:
 
 Then:
 
+**Length is checked against the audio, not the name.** Every textual signal can
+agree and the file still be the wrong song: right title, right folder, right
+album — and six minutes of a track that runs four. So once the download
+finishes, the file's real duration is compared against what Deezer said, and a
+drift past `MUSE_LENGTH_TOLERANCE` multiplies confidence down and says so in
+words: *"runs 5:59 but the track is 4:05 (47% out), so this is probably a
+different recording"*. This is applied on import rather than inside
+`confidence()` for the obvious reason that the file does not exist yet when the
+candidate is picked.
+
 - **≥ 0.95** — filed automatically. Nothing to do.
 - **0.70 – 0.95** — held in **Review** with the reasons shown.
 - **< 0.70** — also held, but it will almost certainly be rejected.
@@ -588,6 +598,7 @@ stat -c "%h" "/data/media/music/<Artist>/<Album> (<Year>)/<NN> - <Title>.flac"
 | `MUSE_SEARCH_RETRIES` | `3` | attempts at issuing a search before failing |
 | `MUSE_AUTO_CONFIDENCE` | `0.95` | at or above this, import without asking |
 | `MUSE_REVIEW_CONFIDENCE` | `0.70` | below this, held but probably wrong |
+| `MUSE_LENGTH_TOLERANCE` | `0.2` | duration drift before a file is called a different recording |
 | `MUSE_WORKERS` | `3` | concurrent Soulseek searches |
 | `MUSE_SMTP_HOST` | — | set to enable email; see **Email** above |
 | `MUSE_SMTP_PORT` | `587` | |