Apply all necessary exclusions to sobelow findings

.sobelow-conf

@@ -4,7 +4,9 @@
   ignore_files: [],
   ignore: [
     # Enabled via config/runtime.exs
-    "Config.HTTPS"
+    "Config.HTTPS",
+    # Placeholder values overridden in runtime.exs from env vars
+    "Config.Secrets"
   ],
   out: nil,
   private: false,

lib/music_library/scrobble_rules.ex

@@ -497,6 +497,9 @@ defmodule MusicLibrary.ScrobbleRules do
     end)
   end
 
+  # column and json_path are hardcoded string literals from internal callers,
+  # never user input. All user-derived values use parameterized ? placeholders.
+  # sobelow_skip ["SQL.Query"]
   defp apply_all_rules_for_column(rules, column, json_path, tracks) do
     {case_clauses, case_params} =
       Enum.reduce(rules, {"", []}, fn rule, {sql_acc, params_acc} ->

lib/music_library_web/components/core_components.ex

@@ -133,6 +133,8 @@ defmodule MusicLibraryWeb.CoreComponents do
     """
   end
 
+  # Renders syntax-highlighted JSON from internal debug structs, not user input.
+  # sobelow_skip ["XSS.Raw"]
   defp format_debug_data(%{type: :json, data: data}) do
     data
     |> Jason.encode!(pretty: true)

lib/music_library_web/components/record_form.ex

@@ -430,6 +430,9 @@ defmodule MusicLibraryWeb.Components.RecordForm do
     {:noreply, assign(socket, form: to_form(changeset, action: :validate))}
   end
 
+  # path comes from Phoenix's consume_uploaded_entries callback —
+  # a framework-generated temp file path, not user input.
+  # sobelow_skip ["Traversal.FileModule"]
   def handle_event("save", %{"record" => record_params}, socket) do
     uploaded_covers =
       consume_uploaded_entries(socket, :cover_data, fn %{path: path}, entry ->

lib/music_library_web/controllers/asset_controller.ex

@@ -75,7 +75,7 @@ defmodule MusicLibraryWeb.AssetController do
 
   # Format is always resolved to either "image/webp" or "image/jpeg" in
   # pick_format/1, so it's safe.
-  # sobelow_skip ["XSS.ContentType"]
+  # sobelow_skip ["XSS.ContentType", "XSS.SendResp"]
   defp respond_with_cache(conn, data, format, etag) do
     conn
     |> put_resp_content_type(format, "utf-8")

lib/music_library_web/live/artist_live/form.ex

@@ -195,6 +195,9 @@ defmodule MusicLibraryWeb.ArtistLive.Form do
     {:noreply, assign(socket, form: to_form(changeset, action: :validate))}
   end
 
+  # path comes from Phoenix's consume_uploaded_entries callback —
+  # a framework-generated temp file path, not user input.
+  # sobelow_skip ["Traversal.FileModule"]
   def handle_event("save", params, socket) do
     artist_info_params = params["artist_info"] || %{}