API: follower lists, blocking, reports, admin; drop Spotify sign-in

- Followers/following lists (paginated), 'follows you', remove a follower
- Blocking severs follows both ways and hides each user from the other
  (profile 404s, search, follows); the blocker sees activity hidden
- Reports for moderation (App Store guideline 1.2)
- First account on a server becomes admin; admins see the report queue,
  resolve reports, and suspend accounts (signs out, blocks login, hides
  the profile, stops sharing). set-role script to promote/demote
- users.onboardedAt drives first-run onboarding; existing accounts are
  backfilled as already onboarded. Empty PATCH /me no longer 500s
- Remove Spotify account sign-in and polling: Spotify caps new apps at 5
  accounts, so Spotify arrives via its Last.fm/ListenBrainz link or the
  Android reader. App-level catalog search stays for exact links
- Shared: QR code generation and profile-link parsing (verified with jsQR)
- Integration test timeout raised; password hashing is slow by design

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/src/services/blocks.ts

@@ -0,0 +1,30 @@
+import { and, eq, or } from 'drizzle-orm';
+import { db, schema } from '../db';
+
+/** Block relationship between a viewer and another user, in both directions. */
+export async function blockStatus(viewerId: string | undefined, otherId: string) {
+  if (!viewerId || viewerId === otherId) return { viewerBlocked: false, blockedByThem: false };
+  const rows = await db
+    .select()
+    .from(schema.blocks)
+    .where(
+      or(
+        and(eq(schema.blocks.blockerId, viewerId), eq(schema.blocks.blockedId, otherId)),
+        and(eq(schema.blocks.blockerId, otherId), eq(schema.blocks.blockedId, viewerId)),
+      ),
+    );
+  return {
+    viewerBlocked: rows.some((r) => r.blockerId === viewerId),
+    blockedByThem: rows.some((r) => r.blockerId === otherId),
+  };
+}
+
+/** Everyone the viewer shouldn't see in lists or search: people they blocked and people who blocked them. */
+export async function hiddenUserIds(viewerId: string | undefined): Promise<Set<string>> {
+  if (!viewerId) return new Set();
+  const rows = await db
+    .select()
+    .from(schema.blocks)
+    .where(or(eq(schema.blocks.blockerId, viewerId), eq(schema.blocks.blockedId, viewerId)));
+  return new Set(rows.map((r) => (r.blockerId === viewerId ? r.blockedId : r.blockerId)));
+}

apps/api/src/services/nowPlaying.ts

@@ -74,8 +74,9 @@ export async function getRecentPlays(userId: string, limit = 10): Promise<Recent
   return plays.map((p) => ({ track: tracks.get(p.trackId)!, source: p.source, playedAt: p.startedAt.toISOString() }));
 }
 
-export const isSharingPaused = (user: Pick<User, 'sharingPausedUntil'>) =>
-  Boolean(user.sharingPausedUntil && user.sharingPausedUntil > new Date());
+/** Paused by the user, or suspended by a moderator: nothing new is shared either way. */
+export const isSharingPaused = (user: Pick<User, 'sharingPausedUntil'> & Partial<Pick<User, 'suspendedAt'>>) =>
+  Boolean(user.suspendedAt) || Boolean(user.sharingPausedUntil && user.sharingPausedUntil > new Date());
 
 /** Starting a pause: whatever was playing becomes "played … ago" for friends. */
 export async function pauseSharing(userId: string) {