fix(birdnet-pipy): fix icecast crash and Live Feed broken in ingress

Two fixes for the birdnet-pipy addon:

1. Icecast log permission error: 01-structure.sh creates /app/data/logs
   as root, but start-icecast.sh runs via gosu icecast2. The first log
   write fails with "Permission denied", crashing icecast in a restart
   loop (502 Bad Gateway on the Live Feed page). Fix: chown the log dir
   and file to icecast2 before dropping privileges.

2. Live Feed double-prefixed request in ingress mode: the "/stream/"
   sub_filter rule also matches 'api.get("/stream/config")' in the JS
   bundle, producing a request like
   /hassio_ingress/TOKEN/api/hassio_ingress/TOKEN/stream/config (404).
   The upstream frontend (BirdNET-PiPy >= 0.6.2) now strips the leading
   slash from stream URLs so they resolve via <base href> — the
   sub_filter rule is no longer needed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

birdnet-pipy/rootfs/etc/nginx/includes/ingress_params.conf

@@ -15,9 +15,11 @@ sub_filter 'src="/' 'src="%%ingress_entry%%/';
 sub_filter '"/api' '"%%ingress_entry%%/api';
 sub_filter "'/api" "'%%ingress_entry%%/api";
 
-# Rewrite stream paths
-sub_filter '"/stream/' '"%%ingress_entry%%/stream/';
-sub_filter "'/stream/" "'%%ingress_entry%%/stream/";
+# Do NOT rewrite "/stream/" — LiveFeed.vue strips the leading slash from
+# stream URLs returned by /api/stream/config so they resolve relative to
+# <base href="%%ingress_entry%%/"> (injected above). Adding a sub_filter
+# for '/stream/' would also rewrite the literal 'api.get("/stream/config")'
+# inside the JS bundle, producing a double-prefixed request.
 
 # Rewrite Socket.IO default path in the client library
 sub_filter '"/socket.io' '"%%ingress_entry%%/socket.io';

birdnet-pipy/rootfs/etc/services.d/icecast/run

@@ -2,4 +2,15 @@
 # shellcheck shell=bash
 set -euo pipefail
 export PULSE_SERVER="${PULSE_SERVER:-unix:/run/pulse/native}"
+
+# Ensure the log directory and file are writable by the icecast2 user.
+# /app/data/logs is created as root by 01-structure.sh, but start-icecast.sh
+# runs via gosu icecast2 and would otherwise fail with "Permission denied"
+# on the first log write, taking icecast down before it can boot.
+mkdir -p /app/data/logs
+touch /app/data/logs/icecast.log
+# Use `icecast2:` (trailing colon) so chown picks the user's primary group,
+# which is `icecast` on Debian, not `icecast2`.
+chown icecast2: /app/data/logs /app/data/logs/icecast.log
+
 gosu icecast2 /usr/local/bin/start-icecast.sh