Add anonymous playback with an optional Spotify-style preview cap

New Playback:AllowAnonymousListening / Playback:AnonymousFragmentSeconds
settings control whether a request without a session can stream at all,
and if so, whether it's limited to a fragment instead of the full track:

- GET /tracks/{id}/stream and GET /youtube/tracks/{videoId}/stream no
  longer require authorization outright; the handlers gate on the config
  instead, so both keep working exactly as before when it's off (the
  default).
- The fragment cap is enforced by the Streaming Gateway, not the client:
  the stream ticket now carries an optional maxBytes claim (computed from
  AnonymousFragmentSeconds and the transcoder's known bitrate), and
  TicketValidationMiddleware clamps the Range it forwards to SeaweedFS to
  stay under it — synthesizing one if the request didn't send one, and
  answering 416 outright if the requested range starts past the cap.
- A YouTube track that hasn't been provisioned server-side yet streams
  straight from YouTube's CDN, bypassing the Gateway entirely — there's no
  way to cap that, so an anonymous request for one is refused (409) instead
  of silently handing out an uncapped stream.
- ListeningHistory has a non-nullable UserId, so anonymous plays simply
  don't get recorded rather than trying to force a row through the FK.

Also fixes a real, pre-existing bug this surfaced: the AppSettings.Development.json
of the Api, Worker, and StreamingGateway all pointed StreamTicket/Workers
paths at "../../deploy/..." — one directory short of deploy/'s actual
location at the repo root relative to each project's own folder. Docker
never hit this (it mounts an absolute /keys path), so it had apparently
never been exercised via `dotnet run` before.

backend/Core/Musify.Application/Services/TrackStreamIssuer.cs

@@ -9,18 +9,20 @@ public sealed class TrackStreamIssuer(
     IDatabase database,
     IStreamTicketService ticketService,
     TrackConfiguration trackConfiguration,
-    StreamGatewayConfiguration streamGatewayConfiguration)
+    StreamGatewayConfiguration streamGatewayConfiguration,
+    PlaybackConfiguration playbackConfiguration)
 {
     public async Task<TrackStreamResponse> IssueAsync(
         Guid trackId,
         string audioFolderName,
-        long userId,
+        long? userId,
         CancellationToken cancellationToken)
     {
         var folderPath = trackConfiguration.Routes.BuildProcessedAudioPath(audioFolderName);
         var keyPrefix = $"{folderPath}/";
 
-        var ticket = ticketService.IssueTicket(userId, keyPrefix);
+        var maxBytes = AnonymousFragmentBytes(userId);
+        var ticket = ticketService.IssueTicket(userId, keyPrefix, maxBytes);
 
         var manifestUrl = string.Join('/',
             streamGatewayConfiguration.PublicBaseUrl.TrimEnd('/'),
@@ -28,14 +30,27 @@ public sealed class TrackStreamIssuer(
             folderPath,
             streamGatewayConfiguration.AudioFileName);
 
-        var newListeningHistory = new ListeningHistory
+        // Anonymous listeners have no User row to satisfy ListeningHistory's foreign key against, and
+        // their plays aren't "history" anyone can look back on anyway, so there's nothing to record.
+        if (userId is not null)
         {
-            UserId = userId,
-            TrackId = trackId,
-        };
-        await database.ListeningHistories.AddAsync(newListeningHistory, cancellationToken);
-        await database.SaveChangesAsync(cancellationToken);
+            var newListeningHistory = new ListeningHistory
+            {
+                UserId = userId.Value,
+                TrackId = trackId,
+            };
+            await database.ListeningHistories.AddAsync(newListeningHistory, cancellationToken);
+            await database.SaveChangesAsync(cancellationToken);
+        }
 
         return new TrackStreamResponse(manifestUrl, ticket.Token, ticket.ExpiresInSeconds);
     }
+
+    private long? AnonymousFragmentBytes(long? userId)
+    {
+        if (userId is not null || playbackConfiguration.AnonymousFragmentSeconds <= 0)
+            return null;
+
+        return (long)playbackConfiguration.AnonymousFragmentSeconds * playbackConfiguration.EstimatedAudioBytesPerSecond;
+    }
 }