Add anonymous playback with an optional Spotify-style preview cap

New Playback:AllowAnonymousListening / Playback:AnonymousFragmentSeconds
settings control whether a request without a session can stream at all,
and if so, whether it's limited to a fragment instead of the full track:

- GET /tracks/{id}/stream and GET /youtube/tracks/{videoId}/stream no
  longer require authorization outright; the handlers gate on the config
  instead, so both keep working exactly as before when it's off (the
  default).
- The fragment cap is enforced by the Streaming Gateway, not the client:
  the stream ticket now carries an optional maxBytes claim (computed from
  AnonymousFragmentSeconds and the transcoder's known bitrate), and
  TicketValidationMiddleware clamps the Range it forwards to SeaweedFS to
  stay under it — synthesizing one if the request didn't send one, and
  answering 416 outright if the requested range starts past the cap.
- A YouTube track that hasn't been provisioned server-side yet streams
  straight from YouTube's CDN, bypassing the Gateway entirely — there's no
  way to cap that, so an anonymous request for one is refused (409) instead
  of silently handing out an uncapped stream.
- ListeningHistory has a non-nullable UserId, so anonymous plays simply
  don't get recorded rather than trying to force a row through the FK.

Also fixes a real, pre-existing bug this surfaced: the AppSettings.Development.json
of the Api, Worker, and StreamingGateway all pointed StreamTicket/Workers
paths at "../../deploy/..." — one directory short of deploy/'s actual
location at the repo root relative to each project's own folder. Docker
never hit this (it mounts an absolute /keys path), so it had apparently
never been exercised via `dotnet run` before.

backend/Hosts/Musify.Api/AppSettings.Development.json

@@ -31,7 +31,7 @@
         "PublicBaseUrl": "http://localhost:8081"
     },
     "StreamTicket": {
-        "PrivateKeyPath": "../../deploy/keys/stream_private.pem"
+        "PrivateKeyPath": "../../../deploy/keys/stream_private.pem"
     },
     "OpenTelemetry": {
         "OtlpEndpoint": "http://localhost:4317"
@@ -41,7 +41,7 @@
     },
     "Workers": {
         "Routes": {
-            "TemporaryFilesDirectory": "../../deploy/.tmp"
+            "TemporaryFilesDirectory": "../../../deploy/.tmp"
         }
     }
 }

backend/Hosts/Musify.Api/AppSettings.json

@@ -48,6 +48,11 @@
     "OpenTelemetry": {
         "OtlpEndpoint": ""
     },
+    "Playback": {
+        "AllowAnonymousListening": false,
+        "AnonymousFragmentSeconds": 0,
+        "EstimatedAudioBytesPerSecond": 16000
+    },
     "YouTube": {
         "Enabled": true,
         "GeographicalLocation": "US",

backend/Hosts/Musify.Api/Endpoints/TrackEndpoints.cs

@@ -36,8 +36,7 @@ public static class TrackEndpoints
 
         group.MapGet("/{id}/stream", GetTrackStream)
             .WithName("GetTrackStream")
-            .WithSummary("Get A Streaming Manifest URL And Ticket For A Track.")
-            .RequireAuthorization()
+            .WithSummary("Get A Streaming Manifest URL And Ticket For A Track. Works Anonymously When The Playback Configuration Allows It.")
             .Produces<TrackStreamResponse>()
             .Produces(StatusCodes.Status401Unauthorized)
             .Produces(StatusCodes.Status404NotFound);
@@ -126,7 +125,7 @@ public static class TrackEndpoints
         Guid id,
         CancellationToken cancellationToken)
     {
-        var result = await mediator.Send(new GetTrackStreamQuery(id, currentUser.RequiredId), cancellationToken);
+        var result = await mediator.Send(new GetTrackStreamQuery(id, currentUser.Id), cancellationToken);
         return result.ToHttpResult();
     }
 

backend/Hosts/Musify.Api/Endpoints/YouTubeEndpoints.cs

@@ -32,11 +32,11 @@ public static class YouTubeEndpoints
 
         group.MapGet("/tracks/{videoId}/stream", GetTrackStream)
             .WithName("GetYouTubeTrackStream")
-            .WithSummary("Resolve Playback For A YouTube Track: Server Stream If Downloaded, Direct YouTube Stream Otherwise.")
-            .RequireAuthorization()
+            .WithSummary("Resolve Playback For A YouTube Track: Server Stream If Downloaded, Direct YouTube Stream Otherwise. Works Anonymously When The Playback Configuration Allows It.")
             .Produces<YouTubeStreamResponse>()
             .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status404NotFound);
+            .Produces(StatusCodes.Status404NotFound)
+            .Produces(StatusCodes.Status409Conflict);
 
         return app;
     }
@@ -48,7 +48,7 @@ public static class YouTubeEndpoints
         CancellationToken cancellationToken)
     {
         var result = await mediator.Send(
-            new ResolveYouTubeTrackStreamCommand(videoId, currentUser.RequiredId),
+            new ResolveYouTubeTrackStreamCommand(videoId, currentUser.Id),
             cancellationToken);
 
         return result.ToHttpResult();