Add API and worker: accounts, follows, now-playing, cross-service links

- Fastify API with cookie (web) and bearer (mobile) sessions, follows,
  pinned friends, featured songs, account deletion, Redis-backed rate limits
- Providers: Spotify (OAuth), Last.fm, ListenBrainz, Plex (PIN flow and
  server discovery), Jellyfin (token auth, revoked on disconnect)
- Worker polls on an adaptive schedule in a Redis sorted set, so polling
  scales horizontally and API usage tracks whether anyone is watching
- Track resolver links songs across services via ISRC (Deezer, Spotify),
  iTunes search and song.link
- Realtime updates over WebSocket fan out through Redis pub/sub
- User-supplied server URLs are restricted to public addresses, checked
  both up front and at connect time to defeat DNS rebinding

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/src/routes/webhooks.ts

@@ -0,0 +1,48 @@
+/**
+ * Inbound webhooks from Plex (Plex Pass) and the Jellyfin Webhook plugin.
+ *
+ * We don't trust or parse the payload: a webhook only means "something
+ * changed", so we poll that connection right away. That keeps one code path
+ * for state, works with any Jellyfin template, and means a forged request can
+ * at most cause an extra poll. The secret in the URL identifies the connection.
+ */
+import { and, eq } from 'drizzle-orm';
+import type { FastifyInstance } from 'fastify';
+import type { NowPlayingProvider } from '@musicshare/shared';
+import { db, schema } from '../db';
+import { pollSoon } from '../services/scheduler';
+
+export async function webhookRoutes(app: FastifyInstance) {
+  // Plex posts multipart/form-data (sometimes with a thumbnail attached). We
+  // ignore bodies entirely, so accept any content type without parsing.
+  app.addContentTypeParser('*', { bodyLimit: 10 * 1024 * 1024 }, (_req, payload, done) => {
+    payload.resume();
+    payload.on('end', () => done(null, undefined));
+    payload.on('error', done);
+  });
+  app.removeContentTypeParser('application/json');
+  app.addContentTypeParser('application/json', (_req, payload, done) => {
+    payload.resume();
+    payload.on('end', () => done(null, undefined));
+  });
+
+  app.post<{ Params: { provider: string; secret: string } }>(
+    '/webhooks/:provider/:secret',
+    { config: { rateLimit: { max: 120, timeWindow: '1 minute' } } },
+    async (req, reply) => {
+      const [conn] = await db
+        .select({ id: schema.connections.id })
+        .from(schema.connections)
+        .where(
+          and(
+            eq(schema.connections.webhookSecret, req.params.secret),
+            eq(schema.connections.provider, req.params.provider as NowPlayingProvider),
+            eq(schema.connections.status, 'active'),
+          ),
+        );
+      if (conn) await pollSoon([conn.id]);
+      // Same response either way, so secrets can't be probed.
+      return reply.status(204).send();
+    },
+  );
+}