fix: wire auth PIN to frontend, clean up dead constants

- Frontend now reads auth_pin from /api/state and includes X-Pedal-Auth on all non-GET requests
- Fixed test imports after removing module-level BLOCK_SIZE/SAMPLE_RATE constants
- Removed rogue test_issue_2_3.py from tracking

tests/test_stability.py

@@ -27,6 +27,10 @@ from src.presets.types import FXBlock, FXType, Preset
 
 # ── Configuration ──────────────────────────────────────────────────────────────
 
+# Local constants (no longer exported by src.dsp.pipeline)
+BLOCK_SIZE = 256
+SAMPLE_RATE = 48000
+
 # 1 hour of audio at 48 kHz / 256 samples per block
 BLOCKS_PER_HOUR = int(SAMPLE_RATE / BLOCK_SIZE * 3600)  # 675,000