Add Apple Music, Last.fm sign-in, and a fallback for Spotify's account cap

- Apple Music: sign MusicKit developer tokens (ES256 via node:crypto),
  accept the Music User Token from the iOS app, and poll recently played.
  Apple has no now-playing API or play timestamps, so a new top song is
  shown as playing for its length; connecting records a baseline so an
  old song isn't announced as current
- Last.fm web auth ("Sign in with Last.fm") instead of typing a
  username; session key stored encrypted
- Spotify accounts rejected by the 5-user development cap are sent back
  with error=spotify_limited instead of a 500, so apps can offer
  Spotify via Last.fm

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/vitest.config.ts

@@ -1,5 +1,9 @@
+import { generateKeyPairSync } from 'node:crypto';
 import { defineConfig } from 'vitest/config';
 
+// Throwaway MusicKit-style key so Apple developer tokens can be signed and verified in tests.
+const appleKey = generateKeyPairSync('ec', { namedCurve: 'P-256' });
+
 /**
  * Tests run against a dedicated Postgres database and Redis DB index, never
  * the dev ones (test/helpers.ts refuses to wipe anything else). Override with
@@ -14,9 +18,14 @@ const testEnv = {
   API_PUBLIC_URL: 'https://api.test',
   ALLOW_PRIVATE_SERVER_URLS: 'false',
   LASTFM_API_KEY: 'test-lastfm-key',
-  SPOTIFY_CLIENT_ID: '',
-  SPOTIFY_CLIENT_SECRET: '',
+  LASTFM_SHARED_SECRET: 'test-lastfm-secret',
+  SPOTIFY_CLIENT_ID: 'test-spotify-id',
+  SPOTIFY_CLIENT_SECRET: 'test-spotify-secret',
   ODESLI_API_KEY: '',
+  APPLE_TEAM_ID: 'TEAMID1234',
+  APPLE_MUSICKIT_KEY_ID: 'KEYID12345',
+  APPLE_MUSICKIT_PRIVATE_KEY: appleKey.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString().replace(/\n/g, '\\n'),
+  APPLE_TEST_PUBLIC_KEY: appleKey.publicKey.export({ type: 'spki', format: 'pem' }).toString(),
 };
 
 export default defineConfig({