FIX: 11 bugs bảo mật/ổn định (static mount chặn dotfile, delete traversal, cleanup giữ clips serverFileId, upload whitelist, password strength, auth audio endpoints, pedalboard==0.9.19, vendor CDN local) + FEATURE: Carla bridge preview/export MIDI notes âm VSTi (POST /midi-render, /carla-play-notes, nút Preview VSTi/Export MIDI->Audio; pedalboard 0.9.19 raw MIDI bytes; SONICFORGE_STORAGE_DIR cô lập test storage)

app/static/js/services/api.js

@@ -86,6 +86,12 @@ window.API_BASE_URL = window.API_BASE_URL || window.location.origin;
         carlaMidi: (payload) => apiRequest('/api/v1/plugins/carla-midi', { method: 'POST', body: JSON.stringify(payload) }),
         // Quick-render preview VSTi (âm thật = âm export, cùng code path)
         previewInstrument: (payload) => apiRequest('/api/v1/plugins/preview', { method: 'POST', body: JSON.stringify(payload) }),
+        // Render MIDI notes → WAV bằng VSTi (pedalboard, âm thật) — trả file_id
+        // để UI preview / gán clip vào track / download
+        midiRender: (payload) => apiRequest('/api/v1/plugins/midi-render', { method: 'POST', body: JSON.stringify(payload) }),
+        // Phát dãy MIDI notes realtime qua Carla bridge (OSC) — preview khi
+        // pedalboard không render được plugin (VD VST2)
+        carlaPlayNotes: (payload) => apiRequest('/api/v1/plugins/carla-play-notes', { method: 'POST', body: JSON.stringify(payload) }),
         // Thư viện preset VST3 (.vstpreset) — cầu nối Carla → pedalboard
         listPresets: () => apiRequest('/api/v1/presets', { method: 'GET' }),
         uploadPreset: (file, pluginHint) => {