feat: add protected public web lyrics workflow

docker-compose.yml

@@ -5,7 +5,7 @@ services:
     build:
       context: .
       args:
-        VERSION: v2026.08.25-r2
+        VERSION: v2026.08.25-r3
     restart: unless-stopped
     ports:
       - "127.0.0.1:8083:8080"
@@ -14,13 +14,13 @@ services:
       - no-new-privileges:true
     cap_drop:
       - ALL
-    pids_limit: 32
-    mem_limit: 64m
-    cpus: 0.25
+    pids_limit: 64
+    mem_limit: 128m
+    cpus: 0.5
     tmpfs:
       - /tmp:size=8m,mode=1777
     healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/"]
+      test: ["CMD", "/lrc-local", "--healthcheck", "http://127.0.0.1:8080/health"]
       interval: 30s
       timeout: 3s
       retries: 3