Add Apple Music, Last.fm sign-in, and a fallback for Spotify's account cap

- Apple Music: sign MusicKit developer tokens (ES256 via node:crypto),
  accept the Music User Token from the iOS app, and poll recently played.
  Apple has no now-playing API or play timestamps, so a new top song is
  shown as playing for its length; connecting records a baseline so an
  old song isn't announced as current
- Last.fm web auth ("Sign in with Last.fm") instead of typing a
  username; session key stored encrypted
- Spotify accounts rejected by the 5-user development cap are sent back
  with error=spotify_limited instead of a 500, so apps can offer
  Spotify via Last.fm

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/.env.example

@@ -15,9 +15,16 @@ SPOTIFY_CLIENT_ID=
 SPOTIFY_CLIENT_SECRET=
 # https://www.last.fm/api/account/create
 LASTFM_API_KEY=
+# Shared secret from the same Last.fm API account; enables one-tap "Sign in with Last.fm"
+LASTFM_SHARED_SECRET=
 # song.link API key (request at https://odesli.co). Enables YouTube Music/TIDAL links; without it those fall back to search.
 ODESLI_API_KEY=
 # Stable identifier for this app in Plex's auth flow
 PLEX_CLIENT_ID=musicshare-dev
 # Let users connect Jellyfin/Plex servers on private networks (LAN). Never enable in a hosted deployment.
 ALLOW_PRIVATE_SERVER_URLS=false
+# Apple Music: Apple Developer → Certificates, IDs & Profiles → Keys → new key with MusicKit enabled.
+# Paste the .p8 contents with newlines as \n.
+APPLE_TEAM_ID=
+APPLE_MUSICKIT_KEY_ID=
+APPLE_MUSICKIT_PRIVATE_KEY=