Add API and worker: accounts, follows, now-playing, cross-service links

- Fastify API with cookie (web) and bearer (mobile) sessions, follows,
  pinned friends, featured songs, account deletion, Redis-backed rate limits
- Providers: Spotify (OAuth), Last.fm, ListenBrainz, Plex (PIN flow and
  server discovery), Jellyfin (token auth, revoked on disconnect)
- Worker polls on an adaptive schedule in a Redis sorted set, so polling
  scales horizontally and API usage tracks whether anyone is watching
- Track resolver links songs across services via ISRC (Deezer, Spotify),
  iTunes search and song.link
- Realtime updates over WebSocket fan out through Redis pub/sub
- User-supplied server URLs are restricted to public addresses, checked
  both up front and at connect time to defeat DNS rebinding

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/src/env.ts

@@ -0,0 +1,42 @@
+import 'dotenv/config';
+import { z } from 'zod';
+
+const optional = z
+  .string()
+  .optional()
+  .transform((v) => (v ? v : undefined));
+
+const schema = z.object({
+  NODE_ENV: z.string().default('development'),
+  DATABASE_URL: z.string().default('postgres://musicshare:musicshare@localhost:5447/musicshare'),
+  REDIS_URL: z.string().default('redis://localhost:6380'),
+  PORT: z.coerce.number().default(4000),
+  WEB_URL: z.string().default('http://localhost:3737'),
+  API_PUBLIC_URL: z.string().default('http://127.0.0.1:4000'),
+  COOKIE_SECURE: z
+    .string()
+    .default('false')
+    .transform((v) => v === 'true'),
+  TOKEN_ENCRYPTION_KEY: z
+    .string()
+    .refine((v) => Buffer.from(v, 'base64').length === 32, 'TOKEN_ENCRYPTION_KEY must be 32 bytes, base64-encoded'),
+  SPOTIFY_CLIENT_ID: optional,
+  SPOTIFY_CLIENT_SECRET: optional,
+  LASTFM_API_KEY: optional,
+  ODESLI_API_KEY: optional,
+  /** Identifies this app to Plex. Keep it stable: changing it invalidates users' Plex authorizations. */
+  PLEX_CLIENT_ID: z.string().default('musicshare-dev'),
+  /**
+   * Allow Jellyfin/Plex server URLs on private networks. Only enable for local
+   * dev or self-hosting: in a hosted deployment it lets users make the server
+   * request internal addresses (SSRF).
+   */
+  ALLOW_PRIVATE_SERVER_URLS: z
+    .string()
+    .default('false')
+    .transform((v) => v === 'true'),
+});
+
+export const env = schema.parse(process.env);
+
+export const spotifyConfigured = Boolean(env.SPOTIFY_CLIENT_ID && env.SPOTIFY_CLIENT_SECRET);