API: follower lists, blocking, reports, admin; drop Spotify sign-in

- Followers/following lists (paginated), 'follows you', remove a follower
- Blocking severs follows both ways and hides each user from the other
  (profile 404s, search, follows); the blocker sees activity hidden
- Reports for moderation (App Store guideline 1.2)
- First account on a server becomes admin; admins see the report queue,
  resolve reports, and suspend accounts (signs out, blocks login, hides
  the profile, stops sharing). set-role script to promote/demote
- users.onboardedAt drives first-run onboarding; existing accounts are
  backfilled as already onboarded. Empty PATCH /me no longer 500s
- Remove Spotify account sign-in and polling: Spotify caps new apps at 5
  accounts, so Spotify arrives via its Last.fm/ListenBrainz link or the
  Android reader. App-level catalog search stays for exact links
- Shared: QR code generation and profile-link parsing (verified with jsQR)
- Integration test timeout raised; password hashing is slow by design

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/src/app.ts

@@ -9,11 +9,13 @@ import { env } from './env';
 import { loadUser } from './lib/auth';
 import { HttpError } from './lib/http';
 import { redis } from './lib/redis';
+import { adminRoutes } from './routes/admin';
 import { authRoutes } from './routes/auth';
 import { connectionRoutes } from './routes/connections';
 import { deviceRoutes } from './routes/devices';
 import { meRoutes } from './routes/me';
 import { realtimeRoutes } from './routes/realtime';
+import { safetyRoutes } from './routes/safety';
 import { trackRoutes } from './routes/tracks';
 import { userRoutes } from './routes/users';
 import { webhookRoutes } from './routes/webhooks';
@@ -55,6 +57,8 @@ export async function buildApp({ logger = true, rateLimits = true }: { logger?:
   await app.register(authRoutes);
   await app.register(meRoutes);
   await app.register(userRoutes);
+  await app.register(safetyRoutes);
+  await app.register(adminRoutes);
   await app.register(trackRoutes);
   await app.register(connectionRoutes);
   await app.register(deviceRoutes);