feat(api): real login + listening wired to the backend contract

Replace the faked ConnectPage login with a real /auth/login -> /auth/me
flow, including loading/error states. Add a backend-contract adapter layer
(api/mappers.ts) translating the backend's snake_case, lean *Out schemas and
{items,total,limit,offset} paging into the UI's camelCase domain types, so
swapping backends only touches the mappers.

- auth: chained login (tokens) + /auth/me (user); refresh on snake_case;
  expiresIn optional (reauth is 401-driven, backend sends no TTL)
- streaming: GET /stream/{id}?token= (token query param for <audio>); SW
  audio cache route + tests follow the path change (token stays cache-stable)
- library/playlists/likes/admin: correct paths (/tracks not /library/tracks),
  page/pageSize<->limit/offset, duration_seconds->durationMs, likes as
  append-only POST /likes event-log, admin is_superuser<->role
- downloads/storage: marked provisional (backend routes still stubs)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/sw-core.test.ts

@@ -8,21 +8,21 @@ import {
 
 test('trackIdFromUrl extracts the content id from a stream URL', () => {
   expect(
-    trackIdFromUrl('https://host/api/v1/streaming/tracks/abc123?token=xyz'),
+    trackIdFromUrl('https://host/api/v1/stream/abc123?token=xyz'),
   ).toBe('abc123');
   expect(trackIdFromUrl('https://host/api/v1/library/albums')).toBeNull();
 });
 
 test('cacheKeyFor strips the token so the key is token-stable', () => {
-  const a = cacheKeyFor('https://host/api/v1/streaming/tracks/t1?token=AAA');
-  const b = cacheKeyFor('https://host/api/v1/streaming/tracks/t1?token=BBB');
+  const a = cacheKeyFor('https://host/api/v1/stream/t1?token=AAA');
+  const b = cacheKeyFor('https://host/api/v1/stream/t1?token=BBB');
   expect(a).toBe(b);
-  expect(a).toBe('https://host/api/v1/streaming/tracks/t1');
+  expect(a).toBe('https://host/api/v1/stream/t1');
 });
 
 test('cacheKeyFor keeps different origins distinct', () => {
-  expect(cacheKeyFor('https://a/streaming/tracks/t1?token=x')).not.toBe(
-    cacheKeyFor('https://b/streaming/tracks/t1?token=x'),
+  expect(cacheKeyFor('https://a/stream/t1?token=x')).not.toBe(
+    cacheKeyFor('https://b/stream/t1?token=x'),
   );
 });