Add API and worker: accounts, follows, now-playing, cross-service links

- Fastify API with cookie (web) and bearer (mobile) sessions, follows,
  pinned friends, featured songs, account deletion, Redis-backed rate limits
- Providers: Spotify (OAuth), Last.fm, ListenBrainz, Plex (PIN flow and
  server discovery), Jellyfin (token auth, revoked on disconnect)
- Worker polls on an adaptive schedule in a Redis sorted set, so polling
  scales horizontally and API usage tracks whether anyone is watching
- Track resolver links songs across services via ISRC (Deezer, Spotify),
  iTunes search and song.link
- Realtime updates over WebSocket fan out through Redis pub/sub
- User-supplied server URLs are restricted to public addresses, checked
  both up front and at connect time to defeat DNS rebinding

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/src/routes/auth.ts

@@ -0,0 +1,44 @@
+import { hash, verify } from '@node-rs/argon2';
+import { eq, or } from 'drizzle-orm';
+import type { FastifyInstance } from 'fastify';
+import { loginSchema, registerSchema } from '@musicshare/shared';
+import { db, schema } from '../db';
+import { SESSION_COOKIE, createSession } from '../lib/auth';
+import { HttpError } from '../lib/http';
+import { toMeDTO } from './me';
+
+const authRateLimit = { config: { rateLimit: { max: 10, timeWindow: '1 minute' } } };
+
+export async function authRoutes(app: FastifyInstance) {
+  app.post('/auth/register', authRateLimit, async (req, reply) => {
+    const input = registerSchema.parse(req.body);
+    const [taken] = await db
+      .select({ username: schema.users.username, email: schema.users.email })
+      .from(schema.users)
+      .where(or(eq(schema.users.username, input.username), eq(schema.users.email, input.email)));
+    if (taken) throw new HttpError(409, taken.email === input.email ? 'Email already registered' : 'Username taken');
+
+    const [user] = await db
+      .insert(schema.users)
+      .values({ username: input.username, email: input.email, passwordHash: await hash(input.password) })
+      .returning();
+    const token = await createSession(user!.id, reply);
+    return { user: toMeDTO(user!), token };
+  });
+
+  app.post('/auth/login', authRateLimit, async (req, reply) => {
+    const input = loginSchema.parse(req.body);
+    const [user] = await db.select().from(schema.users).where(eq(schema.users.email, input.email));
+    if (!user || !(await verify(user.passwordHash, input.password))) {
+      throw new HttpError(401, 'Invalid email or password');
+    }
+    const token = await createSession(user.id, reply);
+    return { user: toMeDTO(user), token };
+  });
+
+  app.post('/auth/logout', async (req, reply) => {
+    if (req.sessionId) await db.delete(schema.sessions).where(eq(schema.sessions.id, req.sessionId));
+    reply.clearCookie(SESSION_COOKIE, { path: '/' });
+    return { ok: true };
+  });
+}