API: follower lists, blocking, reports, admin; drop Spotify sign-in

- Followers/following lists (paginated), 'follows you', remove a follower
- Blocking severs follows both ways and hides each user from the other
  (profile 404s, search, follows); the blocker sees activity hidden
- Reports for moderation (App Store guideline 1.2)
- First account on a server becomes admin; admins see the report queue,
  resolve reports, and suspend accounts (signs out, blocks login, hides
  the profile, stops sharing). set-role script to promote/demote
- users.onboardedAt drives first-run onboarding; existing accounts are
  backfilled as already onboarded. Empty PATCH /me no longer 500s
- Remove Spotify account sign-in and polling: Spotify caps new apps at 5
  accounts, so Spotify arrives via its Last.fm/ListenBrainz link or the
  Android reader. App-level catalog search stays for exact links
- Shared: QR code generation and profile-link parsing (verified with jsQR)
- Integration test timeout raised; password hashing is slow by design

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/test/oauth.test.ts

@@ -61,27 +61,3 @@ describe('Last.fm sign-in', () => {
     expect((await app().inject({ url: '/connections/lastfm/callback?state=forged&token=x' })).statusCode).toBe(400);
   });
 });
-
-describe('Spotify sign-in during the limited beta', () => {
-  it('sends users who are not on the allowlist back with a friendly error instead of failing', async () => {
-    vi.stubGlobal(
-      'fetch',
-      routeFetch([
-        [/accounts\.spotify\.com\/api\/token/, () => json({ access_token: 'a', refresh_token: 'r', expires_in: 3600 })],
-        [/api\.spotify\.com\/v1\/me$/, () => json({ error: { status: 403, message: 'User not registered in the Developer Dashboard' } }, 403)],
-      ]),
-    );
-    const { token } = await createUser(app(), 'alice');
-    const start = await app().inject({
-      method: 'POST',
-      url: '/connections/spotify/authorize',
-      headers: bearer(token),
-      payload: { client: 'mobile', returnTo: 'musicshare://settings' },
-    });
-    const state = new URL(start.json().url).searchParams.get('state');
-    const done = await app().inject({ url: `/connections/spotify/callback?state=${state}&code=abc` });
-    expect(done.statusCode).toBe(302);
-    expect(done.headers.location).toBe('musicshare://settings?error=spotify_limited');
-    expect(await db.select().from(schema.connections)).toHaveLength(0);
-  });
-});