API: follower lists, blocking, reports, admin; drop Spotify sign-in

- Followers/following lists (paginated), 'follows you', remove a follower
- Blocking severs follows both ways and hides each user from the other
  (profile 404s, search, follows); the blocker sees activity hidden
- Reports for moderation (App Store guideline 1.2)
- First account on a server becomes admin; admins see the report queue,
  resolve reports, and suspend accounts (signs out, blocks login, hides
  the profile, stops sharing). set-role script to promote/demote
- users.onboardedAt drives first-run onboarding; existing accounts are
  backfilled as already onboarded. Empty PATCH /me no longer 500s
- Remove Spotify account sign-in and polling: Spotify caps new apps at 5
  accounts, so Spotify arrives via its Last.fm/ListenBrainz link or the
  Android reader. App-level catalog search stays for exact links
- Shared: QR code generation and profile-link parsing (verified with jsQR)
- Integration test timeout raised; password hashing is slow by design

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/src/scripts/set-role.ts

@@ -0,0 +1,22 @@
+/**
+ * Promote or demote an account:
+ *   npm run admin:promote -w @musicshare/api -- <username>
+ *   npm run admin:demote  -w @musicshare/api -- <username>
+ * In Docker: docker compose exec api node dist/scripts/set-role.js admin <username>
+ */
+import { eq } from 'drizzle-orm';
+import { db, schema, sql } from '../db';
+
+const [role, username] = process.argv.slice(2);
+if ((role !== 'admin' && role !== 'user') || !username) {
+  console.error('usage: set-role <admin|user> <username>');
+  process.exit(1);
+}
+const updated = await db
+  .update(schema.users)
+  .set({ role })
+  .where(eq(schema.users.username, username.toLowerCase()))
+  .returning({ username: schema.users.username });
+console.log(updated.length ? `${updated[0]!.username} is now ${role}` : `no user named ${username}`);
+await sql.end();
+process.exit(updated.length ? 0 : 1);