API: follower lists, blocking, reports, admin; drop Spotify sign-in

- Followers/following lists (paginated), 'follows you', remove a follower
- Blocking severs follows both ways and hides each user from the other
  (profile 404s, search, follows); the blocker sees activity hidden
- Reports for moderation (App Store guideline 1.2)
- First account on a server becomes admin; admins see the report queue,
  resolve reports, and suspend accounts (signs out, blocks login, hides
  the profile, stops sharing). set-role script to promote/demote
- users.onboardedAt drives first-run onboarding; existing accounts are
  backfilled as already onboarded. Empty PATCH /me no longer 500s
- Remove Spotify account sign-in and polling: Spotify caps new apps at 5
  accounts, so Spotify arrives via its Last.fm/ListenBrainz link or the
  Android reader. App-level catalog search stays for exact links
- Shared: QR code generation and profile-link parsing (verified with jsQR)
- Integration test timeout raised; password hashing is slow by design

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

packages/shared/src/links.ts

@@ -0,0 +1,35 @@
+/** Profile links: what QR codes and invites contain, and how scans are read back. */
+
+const USERNAME = /^[a-z0-9_]{3,32}$/;
+
+/** Shareable profile URL on the website, e.g. https://musicshare.app/u/alice */
+export function profileUrl(webBase: string, username: string): string {
+  return `${webBase.replace(/\/+$/, '')}/u/${encodeURIComponent(username)}`;
+}
+
+/**
+ * Pull a username out of anything a QR scan might contain: a website profile
+ * URL (any host), the app's deep link (musicshare://u/alice), an Expo Go dev
+ * link (exp://…/--/u/alice), or a bare "@alice". Returns null if it isn't one.
+ */
+export function parseProfileLink(text: string): string | null {
+  const raw = text.trim();
+  const at = raw.match(/^@([A-Za-z0-9_]+)$/);
+  if (at) return valid(at[1]!);
+
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  // musicshare://u/alice parses with host "u" and path "/alice"
+  const path = url.protocol === 'musicshare:' ? `/${url.host}${url.pathname}` : url.pathname.replace(/^\/--/, '');
+  const match = path.match(/^\/u\/([^/?#]+)\/?$/);
+  return match ? valid(decodeURIComponent(match[1]!)) : null;
+}
+
+function valid(name: string): string | null {
+  const username = name.toLowerCase();
+  return USERNAME.test(username) ? username : null;
+}