Unlock everything, add a donation link, credit Last.fm, nudge re-linking

- Every feature is free for everyone (the plan system stays for later);
  remaining limits are abuse guards
- Optional website donation link (NEXT_PUBLIC_DONATION_URL). Not shown in
  the mobile apps, where tips to the developer generally need in-app
  purchase
- Last.fm/ListenBrainz-sourced plays link to the user's profile, as
  Last.fm's API terms require
- Connections track when they last saw activity; a scrobbler silent for
  over a week prompts re-linking Spotify (its link expires every 6 months)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/test/social.test.ts

@@ -1,6 +1,5 @@
-import { eq } from 'drizzle-orm';
 import { describe, expect, it } from 'vitest';
-import { db, schema } from '../src/db';
+import { PLAN_ENTITLEMENTS } from '@musicshare/shared';
 import { applyPollResult } from '../src/services/nowPlaying';
 import { bearer, createUser, follow, useTestApp } from './helpers';
 
@@ -80,15 +79,21 @@ describe('pinned friends', () => {
     expect(await feedOrder(alice.token)).toEqual(['*bob', '*dave', 'erin', 'carol']);
   });
 
-  it('enforces the plan limit with 402, and plus raises it', async () => {
-    const { alice } = await setup();
-    for (const name of ['bob', 'carol', 'dave']) expect((await pin(alice.token, name)).statusCode).toBe(200);
-    const fourth = await pin(alice.token, 'erin');
-    expect(fourth.statusCode).toBe(402);
-    expect(fourth.json().error).toBe('You can pin up to 3 friends on your plan');
+  it('caps pins as an abuse guard (402 past the limit), and unpinning frees a slot', async () => {
+    const max = PLAN_ENTITLEMENTS.free.maxPinnedFriends;
+    const alice = await createUser(app(), 'alice');
+    const names = Array.from({ length: max + 1 }, (_, i) => `friend${i}`);
+    for (const name of names) {
+      await createUser(app(), name);
+      await follow(app(), alice.token, name);
+    }
+    for (const name of names.slice(0, max)) expect((await pin(alice.token, name)).statusCode).toBe(200);
+    const over = await pin(alice.token, names[max]!);
+    expect(over.statusCode).toBe(402);
+    expect(over.json().error).toBe(`You can pin up to ${max} friends on your plan`);
 
-    await db.update(schema.users).set({ plan: 'plus' }).where(eq(schema.users.id, alice.user.id));
-    expect((await pin(alice.token, 'erin')).statusCode).toBe(200);
+    await pin(alice.token, names[0]!, 'DELETE');
+    expect((await pin(alice.token, names[max]!)).statusCode).toBe(200);
   });
 
   it('pinning is idempotent and does not count twice', async () => {
@@ -108,10 +113,4 @@ describe('pinned friends', () => {
     expect((await app().inject({ url: '/users/bob', headers: bearer(alice.token) })).json().isPinned).toBe(false);
   });
 
-  it('unpin frees a slot', async () => {
-    const { alice } = await setup();
-    for (const name of ['bob', 'carol', 'dave']) await pin(alice.token, name);
-    await pin(alice.token, 'bob', 'DELETE');
-    expect((await pin(alice.token, 'erin')).statusCode).toBe(200);
-  });
 });