feat(stream): require auth on GET /stream/{id} via token query param

The audio stream endpoint was unauthenticated. Add a get_streaming_user
dependency that accepts the access token either as a ?token= query param
(the browser <audio> element can't send an Authorization header) or a
bearer header for native clients. Update streaming tests accordingly and
add a test asserting unauthenticated requests are rejected with 401.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/v1/streaming.py

@@ -6,7 +6,7 @@ from typing import Annotated
 from fastapi import APIRouter, Header
 from fastapi.responses import StreamingResponse
 
-from app.api.deps import StreamingServiceDep
+from app.api.deps import StreamingServiceDep, StreamUser
 
 router = APIRouter(prefix="/stream", tags=["streaming"])
 
@@ -15,6 +15,7 @@ router = APIRouter(prefix="/stream", tags=["streaming"])
 async def stream_track(
     track_id: uuid.UUID,
     service: StreamingServiceDep,
+    _user: StreamUser,
     range_header: Annotated[str | None, Header(alias="Range")] = None,
 ) -> StreamingResponse:
     result = await service.open_stream(track_id, range_header)