API: follower lists, blocking, reports, admin; drop Spotify sign-in

- Followers/following lists (paginated), 'follows you', remove a follower
- Blocking severs follows both ways and hides each user from the other
  (profile 404s, search, follows); the blocker sees activity hidden
- Reports for moderation (App Store guideline 1.2)
- First account on a server becomes admin; admins see the report queue,
  resolve reports, and suspend accounts (signs out, blocks login, hides
  the profile, stops sharing). set-role script to promote/demote
- users.onboardedAt drives first-run onboarding; existing accounts are
  backfilled as already onboarded. Empty PATCH /me no longer 500s
- Remove Spotify account sign-in and polling: Spotify caps new apps at 5
  accounts, so Spotify arrives via its Last.fm/ListenBrainz link or the
  Android reader. App-level catalog search stays for exact links
- Shared: QR code generation and profile-link parsing (verified with jsQR)
- Integration test timeout raised; password hashing is slow by design

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/src/routes/auth.ts

@@ -1,5 +1,5 @@
 import { hash, verify } from '@node-rs/argon2';
-import { eq, or } from 'drizzle-orm';
+import { count, eq, or, sql } from 'drizzle-orm';
 import type { FastifyInstance } from 'fastify';
 import { loginSchema, registerSchema } from '@musicshare/shared';
 import { db, schema } from '../db';
@@ -18,10 +18,17 @@ export async function authRoutes(app: FastifyInstance) {
       .where(or(eq(schema.users.username, input.username), eq(schema.users.email, input.email)));
     if (taken) throw new HttpError(409, taken.email === input.email ? 'Email already registered' : 'Username taken');
 
-    const [user] = await db
-      .insert(schema.users)
-      .values({ username: input.username, email: input.email, passwordHash: await hash(input.password) })
-      .returning();
+    const passwordHash = await hash(input.password);
+    const user = await db.transaction(async (tx) => {
+      // Serialize sign-ups so two simultaneous "first" accounts can't both become admin.
+      await tx.execute(sql`select pg_advisory_xact_lock(4242)`);
+      const [{ n }] = (await tx.select({ n: count() }).from(schema.users)) as [{ n: number }];
+      const [created] = await tx
+        .insert(schema.users)
+        .values({ username: input.username, email: input.email, passwordHash, role: n === 0 ? 'admin' : 'user' })
+        .returning();
+      return created;
+    });
     const token = await createSession(user!.id, reply);
     return { user: toMeDTO(user!), token };
   });
@@ -32,6 +39,7 @@ export async function authRoutes(app: FastifyInstance) {
     if (!user || !(await verify(user.passwordHash, input.password))) {
       throw new HttpError(401, 'Invalid email or password');
     }
+    if (user.suspendedAt) throw new HttpError(403, 'This account has been suspended');
     const token = await createSession(user.id, reply);
     return { user: toMeDTO(user), token };
   });