Add phone playback reporting and pause sharing to the API

Phones that read system media sessions report playback themselves:
- POST /me/devices issues a per-phone token that can only call
  POST /devices/now-playing; revocable, hashed at rest, 10 per user
- Reports name the app ("via Spotify"); unknown apps use the OS label
- Push-reported playback expires after 9 minutes of silence, since
  phones send a heartbeat every 4 minutes while playing

Users can pause sharing (PUT /me/sharing: 1h, 8h, indefinitely). While
paused, connections aren't polled, phone reports are dropped, nothing is
added to history, and the current track switches to "played … ago".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/src/app.ts

@@ -11,6 +11,7 @@ import { HttpError } from './lib/http';
 import { redis } from './lib/redis';
 import { authRoutes } from './routes/auth';
 import { connectionRoutes } from './routes/connections';
+import { deviceRoutes } from './routes/devices';
 import { meRoutes } from './routes/me';
 import { realtimeRoutes } from './routes/realtime';
 import { trackRoutes } from './routes/tracks';
@@ -56,6 +57,7 @@ export async function buildApp({ logger = true, rateLimits = true }: { logger?:
   await app.register(userRoutes);
   await app.register(trackRoutes);
   await app.register(connectionRoutes);
+  await app.register(deviceRoutes);
   await app.register(realtimeRoutes);
   // registered as its own plugin so its permissive body parsers stay scoped to webhook routes
   await app.register(webhookRoutes);