API: follower lists, blocking, reports, admin; drop Spotify sign-in

- Followers/following lists (paginated), 'follows you', remove a follower
- Blocking severs follows both ways and hides each user from the other
  (profile 404s, search, follows); the blocker sees activity hidden
- Reports for moderation (App Store guideline 1.2)
- First account on a server becomes admin; admins see the report queue,
  resolve reports, and suspend accounts (signs out, blocks login, hides
  the profile, stops sharing). set-role script to promote/demote
- users.onboardedAt drives first-run onboarding; existing accounts are
  backfilled as already onboarded. Empty PATCH /me no longer 500s
- Remove Spotify account sign-in and polling: Spotify caps new apps at 5
  accounts, so Spotify arrives via its Last.fm/ListenBrainz link or the
  Android reader. App-level catalog search stays for exact links
- Shared: QR code generation and profile-link parsing (verified with jsQR)
- Integration test timeout raised; password hashing is slow by design

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

packages/shared/src/schemas.ts

@@ -26,6 +26,8 @@ export const updateMeSchema = z.object({
   bio: z.string().trim().max(280).nullable().optional(),
   avatarUrl: z.url().max(500).nullable().optional(),
   preferredService: z.enum(STREAMING_SERVICES).nullable().optional(),
+  /** Mark onboarding as finished. */
+  onboarded: z.literal(true).optional(),
 });
 
 export const setFeaturedSchema = z.union([
@@ -51,3 +53,10 @@ export const jellyfinConnectSchema = z.object({
 /** Pause sharing: for an hour, until tomorrow, until turned back on, or resume (null). */
 export const PAUSE_OPTIONS = ['1h', '8h', 'indefinitely'] as const;
 export const setSharingSchema = z.object({ pause: z.enum(PAUSE_OPTIONS).nullable() });
+
+export const REPORT_REASONS = ['spam', 'harassment', 'inappropriate', 'impersonation', 'other'] as const;
+export type ReportReason = (typeof REPORT_REASONS)[number];
+export const reportSchema = z.object({
+  reason: z.enum(REPORT_REASONS),
+  note: z.string().trim().max(500).nullish(),
+});