Add anonymous playback with an optional Spotify-style preview cap

New Playback:AllowAnonymousListening / Playback:AnonymousFragmentSeconds
settings control whether a request without a session can stream at all,
and if so, whether it's limited to a fragment instead of the full track:

- GET /tracks/{id}/stream and GET /youtube/tracks/{videoId}/stream no
  longer require authorization outright; the handlers gate on the config
  instead, so both keep working exactly as before when it's off (the
  default).
- The fragment cap is enforced by the Streaming Gateway, not the client:
  the stream ticket now carries an optional maxBytes claim (computed from
  AnonymousFragmentSeconds and the transcoder's known bitrate), and
  TicketValidationMiddleware clamps the Range it forwards to SeaweedFS to
  stay under it — synthesizing one if the request didn't send one, and
  answering 416 outright if the requested range starts past the cap.
- A YouTube track that hasn't been provisioned server-side yet streams
  straight from YouTube's CDN, bypassing the Gateway entirely — there's no
  way to cap that, so an anonymous request for one is refused (409) instead
  of silently handing out an uncapped stream.
- ListeningHistory has a non-nullable UserId, so anonymous plays simply
  don't get recorded rather than trying to force a row through the FK.

Also fixes a real, pre-existing bug this surfaced: the AppSettings.Development.json
of the Api, Worker, and StreamingGateway all pointed StreamTicket/Workers
paths at "../../deploy/..." — one directory short of deploy/'s actual
location at the repo root relative to each project's own folder. Docker
never hit this (it mounts an absolute /keys path), so it had apparently
never been exercised via `dotnet run` before.

backend/Hosts/Musify.StreamingGateway/Authentication/TicketValidator.cs

@@ -6,6 +6,17 @@ using Musify.StreamingGateway.Configuration;
 
 namespace Musify.StreamingGateway.Authentication;
 
+/// <param name="Prefix">The storage key prefix the ticket authorizes reading from. Empty means the
+/// ticket was missing, malformed, expired, or otherwise invalid.</param>
+/// <param name="MaxBytes">When set, the caller is limited to the first <c>MaxBytes</c> bytes of the
+/// object — the anonymous preview fragment cap carried by the <c>maxBytes</c> claim.</param>
+public sealed record TicketValidationResult(string Prefix, long? MaxBytes)
+{
+    public static readonly TicketValidationResult Invalid = new(string.Empty, null);
+
+    public bool IsValid => Prefix.Length > 0;
+}
+
 public sealed class TicketValidator : IDisposable
 {
     private readonly StreamTicketValidationOptions _options;
@@ -34,17 +45,23 @@ public sealed class TicketValidator : IDisposable
         };
     }
 
-    public async Task<string> ValidateTicketAsync(string? token)
+    public async Task<TicketValidationResult> ValidateTicketAsync(string? token)
     {
         if (string.IsNullOrWhiteSpace(token))
-            return string.Empty;
+            return TicketValidationResult.Invalid;
 
         var result = await _handler.ValidateTokenAsync(token, _validationParameters);
         if (!result.IsValid)
-            return string.Empty;
+            return TicketValidationResult.Invalid;
 
         var prefix = result.ClaimsIdentity?.FindFirst("prefix")?.Value;
-        return string.IsNullOrEmpty(prefix)? string.Empty : prefix;
+        if (string.IsNullOrEmpty(prefix))
+            return TicketValidationResult.Invalid;
+
+        var maxBytesClaim = result.ClaimsIdentity?.FindFirst("maxBytes")?.Value;
+        var maxBytes = long.TryParse(maxBytesClaim, out var parsed) ? parsed : (long?)null;
+
+        return new TicketValidationResult(prefix, maxBytes);
     }
 
     public void Dispose() => _rsa.Dispose();

backend/Hosts/Musify.StreamingGateway/Middleware/TicketValidationMiddleware.cs

@@ -1,4 +1,6 @@
 using Microsoft.Extensions.Options;
+using Microsoft.Extensions.Primitives;
+using Microsoft.Net.Http.Headers;
 using Musify.StreamingGateway.Authentication;
 using Musify.StreamingGateway.Configuration;
 
@@ -28,15 +30,16 @@ public sealed class TicketValidationMiddleware(
             token = context.Request.Headers[options.HeaderName].ToString();
         }
 
-        var prefix = await ticketValidator.ValidateTicketAsync(token);
+        var validation = await ticketValidator.ValidateTicketAsync(token);
 
-        if (string.IsNullOrEmpty(prefix))
+        if (!validation.IsValid)
         {
             logger.LogWarning("Rejected media request {Path}: missing or invalid ticket", path);
             context.Response.StatusCode = StatusCodes.Status401Unauthorized;
             return;
         }
 
+        var prefix = validation.Prefix;
         var objectKey = remaining.Value?.TrimStart('/') ?? string.Empty;
 
         if (HasTraversalSegment(objectKey))
@@ -55,10 +58,48 @@ public sealed class TicketValidationMiddleware(
             return;
         }
 
+        if (validation.MaxBytes is { } maxBytes && !TryClampRange(context, maxBytes))
+        {
+            logger.LogInformation(
+                "Rejected media request {ObjectKey}: requested range starts beyond the {MaxBytes}-byte preview limit",
+                objectKey, maxBytes);
+            context.Response.StatusCode = StatusCodes.Status416RangeNotSatisfiable;
+            context.Response.Headers[HeaderNames.ContentRange] = $"bytes */{maxBytes}";
+            return;
+        }
+
         StripQueryParameter(context, options.QueryParameterName);
         await next(context);
     }
 
+    /// <summary>Rewrites the request's <c>Range</c> header so nothing past <paramref name="maxBytes"/>
+    /// is ever asked of the filer — this is what actually enforces the anonymous preview length,
+    /// downstream of the ticket carrying that cap. A request with no <c>Range</c> header (a plain,
+    /// whole-file GET) gets one synthesized, so the filer always responds with a bounded 206 instead of
+    /// streaming the full object. Returns false when the requested range starts at or past the cap, in
+    /// which case the caller should answer 416 directly instead of proxying anything.</summary>
+    private static bool TryClampRange(HttpContext context, long maxBytes)
+    {
+        var rangeHeader = context.Request.Headers.Range;
+        if (StringValues.IsNullOrEmpty(rangeHeader))
+        {
+            context.Request.Headers.Range = $"bytes=0-{maxBytes - 1}";
+            return true;
+        }
+
+        if (!RangeHeaderValue.TryParse(rangeHeader.ToString(), out var range) || range.Ranges.Count != 1)
+            return true;
+
+        var requested = range.Ranges.Single();
+        var start = requested.From ?? 0;
+        if (start >= maxBytes)
+            return false;
+
+        var end = requested.To is { } requestedEnd ? Math.Min(requestedEnd, maxBytes - 1) : maxBytes - 1;
+        context.Request.Headers.Range = $"bytes={start}-{end}";
+        return true;
+    }
+
     private static bool HasTraversalSegment(string objectKey) =>
         objectKey.Split('/').Any(segment => segment is ".." or ".");
 

backend/Hosts/Musify.StreamingGateway/appsettings.Development.json

@@ -1,5 +1,5 @@
 {
   "StreamTicket": {
-    "PublicKeyPath": "../../deploy/keys/stream_public.pem"
+    "PublicKeyPath": "../../../deploy/keys/stream_public.pem"
   }
 }