Add phone playback reporting and pause sharing to the API

Phones that read system media sessions report playback themselves:
- POST /me/devices issues a per-phone token that can only call
  POST /devices/now-playing; revocable, hashed at rest, 10 per user
- Reports name the app ("via Spotify"); unknown apps use the OS label
- Push-reported playback expires after 9 minutes of silence, since
  phones send a heartbeat every 4 minutes while playing

Users can pause sharing (PUT /me/sharing: 1h, 8h, indefinitely). While
paused, connections aren't polled, phone reports are dropped, nothing is
added to history, and the current track switches to "played … ago".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

packages/shared/src/dto.ts

@@ -23,6 +23,8 @@ export interface MeDTO extends UserSummaryDTO {
   email: string;
   bio: string | null;
   preferredService: StreamingService | null;
+  /** ISO time sharing resumes, or null when sharing. Far future means "until turned back on". */
+  sharingPausedUntil: string | null;
   plan: Plan;
   entitlements: Entitlements;
 }
@@ -32,6 +34,8 @@ export interface NowPlayingDTO {
   track: TrackDTO;
   isPlaying: boolean;
   source: NowPlayingProvider;
+  /** The app it's playing in, when a phone reported it (e.g. "Spotify"). */
+  sourceApp: string | null;
   progressMs: number | null;
   updatedAt: string;
 }