Add API and worker: accounts, follows, now-playing, cross-service links

- Fastify API with cookie (web) and bearer (mobile) sessions, follows,
  pinned friends, featured songs, account deletion, Redis-backed rate limits
- Providers: Spotify (OAuth), Last.fm, ListenBrainz, Plex (PIN flow and
  server discovery), Jellyfin (token auth, revoked on disconnect)
- Worker polls on an adaptive schedule in a Redis sorted set, so polling
  scales horizontally and API usage tracks whether anyone is watching
- Track resolver links songs across services via ISRC (Deezer, Spotify),
  iTunes search and song.link
- Realtime updates over WebSocket fan out through Redis pub/sub
- User-supplied server URLs are restricted to public addresses, checked
  both up front and at connect time to defeat DNS rebinding

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/src/server.ts

@@ -0,0 +1,69 @@
+import cookie from '@fastify/cookie';
+import cors from '@fastify/cors';
+import rateLimit from '@fastify/rate-limit';
+import websocket from '@fastify/websocket';
+import Fastify from 'fastify';
+import { ZodError } from 'zod';
+import { sql } from './db';
+import { env } from './env';
+import { loadUser } from './lib/auth';
+import { HttpError } from './lib/http';
+import { redis } from './lib/redis';
+import { authRoutes } from './routes/auth';
+import { connectionRoutes } from './routes/connections';
+import { meRoutes } from './routes/me';
+import { realtimeRoutes } from './routes/realtime';
+import { trackRoutes } from './routes/tracks';
+import { userRoutes } from './routes/users';
+import { webhookRoutes } from './routes/webhooks';
+
+const app = Fastify({ logger: true, trustProxy: true });
+
+await app.register(cors, {
+  origin: [env.WEB_URL],
+  credentials: true,
+  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
+});
+await app.register(cookie);
+// Rate limits are per-route (see `config.rateLimit`); the Redis store makes them global across instances.
+await app.register(rateLimit, { global: false, redis });
+await app.register(websocket);
+
+app.decorateRequest('user', null);
+app.decorateRequest('sessionId', null);
+app.addHook('onRequest', loadUser);
+
+app.setErrorHandler((err, req, reply) => {
+  if (err instanceof ZodError) {
+    return reply.status(400).send({ error: err.issues[0]?.message ?? 'Invalid input', issues: err.issues });
+  }
+  if (err instanceof HttpError) return reply.status(err.status).send({ error: err.message });
+  const status = (err as { statusCode?: number }).statusCode;
+  if (status && status < 500) return reply.status(status).send({ error: (err as Error).message });
+  req.log.error(err);
+  return reply.status(500).send({ error: 'Internal server error' });
+});
+
+app.get('/health', async () => {
+  await Promise.all([sql`select 1`, redis.ping()]);
+  return { ok: true };
+});
+
+await app.register(authRoutes);
+await app.register(meRoutes);
+await app.register(userRoutes);
+await app.register(trackRoutes);
+await app.register(connectionRoutes);
+await app.register(realtimeRoutes);
+// registered as its own plugin so its permissive body parsers stay scoped to webhook routes
+await app.register(webhookRoutes);
+
+for (const signal of ['SIGINT', 'SIGTERM']) {
+  process.on(signal, async () => {
+    await app.close();
+    await sql.end();
+    process.exit(0);
+  });
+}
+
+await app.listen({ port: env.PORT, host: '0.0.0.0' });