Add API and worker: accounts, follows, now-playing, cross-service links

- Fastify API with cookie (web) and bearer (mobile) sessions, follows,
  pinned friends, featured songs, account deletion, Redis-backed rate limits
- Providers: Spotify (OAuth), Last.fm, ListenBrainz, Plex (PIN flow and
  server discovery), Jellyfin (token auth, revoked on disconnect)
- Worker polls on an adaptive schedule in a Redis sorted set, so polling
  scales horizontally and API usage tracks whether anyone is watching
- Track resolver links songs across services via ISRC (Deezer, Spotify),
  iTunes search and song.link
- Realtime updates over WebSocket fan out through Redis pub/sub
- User-supplied server URLs are restricted to public addresses, checked
  both up front and at connect time to defeat DNS rebinding

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/.env.example

@@ -0,0 +1,23 @@
+DATABASE_URL=postgres://musicshare:musicshare@localhost:5447/musicshare
+REDIS_URL=redis://localhost:6380
+PORT=4000
+# Where the web app lives (CORS + post-OAuth redirects)
+WEB_URL=http://localhost:3737
+# Public base URL of this API, used for OAuth redirect URIs.
+# Spotify requires a loopback IP (not "localhost") for http redirect URIs.
+API_PUBLIC_URL=http://127.0.0.1:4000
+COOKIE_SECURE=false
+# 32 random bytes, base64. Generate with: openssl rand -base64 32
+TOKEN_ENCRYPTION_KEY=
+
+# https://developer.spotify.com/dashboard  (redirect URI: $API_PUBLIC_URL/connections/spotify/callback)
+SPOTIFY_CLIENT_ID=
+SPOTIFY_CLIENT_SECRET=
+# https://www.last.fm/api/account/create
+LASTFM_API_KEY=
+# song.link API key (request at https://odesli.co). Enables YouTube Music/TIDAL links; without it those fall back to search.
+ODESLI_API_KEY=
+# Stable identifier for this app in Plex's auth flow
+PLEX_CLIENT_ID=musicshare-dev
+# Let users connect Jellyfin/Plex servers on private networks (LAN). Never enable in a hosted deployment.
+ALLOW_PRIVATE_SERVER_URLS=false