Add anonymous playback with an optional Spotify-style preview cap

New Playback:AllowAnonymousListening / Playback:AnonymousFragmentSeconds
settings control whether a request without a session can stream at all,
and if so, whether it's limited to a fragment instead of the full track:

- GET /tracks/{id}/stream and GET /youtube/tracks/{videoId}/stream no
  longer require authorization outright; the handlers gate on the config
  instead, so both keep working exactly as before when it's off (the
  default).
- The fragment cap is enforced by the Streaming Gateway, not the client:
  the stream ticket now carries an optional maxBytes claim (computed from
  AnonymousFragmentSeconds and the transcoder's known bitrate), and
  TicketValidationMiddleware clamps the Range it forwards to SeaweedFS to
  stay under it — synthesizing one if the request didn't send one, and
  answering 416 outright if the requested range starts past the cap.
- A YouTube track that hasn't been provisioned server-side yet streams
  straight from YouTube's CDN, bypassing the Gateway entirely — there's no
  way to cap that, so an anonymous request for one is refused (409) instead
  of silently handing out an uncapped stream.
- ListeningHistory has a non-nullable UserId, so anonymous plays simply
  don't get recorded rather than trying to force a row through the FK.

Also fixes a real, pre-existing bug this surfaced: the AppSettings.Development.json
of the Api, Worker, and StreamingGateway all pointed StreamTicket/Workers
paths at "../../deploy/..." — one directory short of deploy/'s actual
location at the repo root relative to each project's own folder. Docker
never hit this (it mounts an absolute /keys path), so it had apparently
never been exercised via `dotnet run` before.

backend/Tests/Musify.Application.Tests/Tracks/GetTrackStreamQueryHandlerTests.cs

@@ -1,5 +1,6 @@
 using ErrorOr;
 using Microsoft.EntityFrameworkCore;
+using Musify.Application.Configuration;
 using Musify.Application.Contracts;
 using Musify.Application.Services;
 using Musify.Application.Tests.TestSupport;
@@ -13,17 +14,18 @@ namespace Musify.Application.Tests.Tracks
     {
         private readonly IStreamTicketService ticketService = Substitute.For<IStreamTicketService>();
 
-        private GetTrackStreamQueryHandler CreateHandler()
+        private GetTrackStreamQueryHandler CreateHandler(PlaybackConfiguration? playback = null)
         {
-            ticketService.IssueTicket(Arg.Any<long>(), Arg.Any<string>()).Returns(new StreamTicket("ticket-token", 60));
+            ticketService.IssueTicket(Arg.Any<long?>(), Arg.Any<string>(), Arg.Any<long?>()).Returns(new StreamTicket("ticket-token", 60));
 
             var issuer = new TrackStreamIssuer(
                 Database,
                 ticketService,
                 TestConfigurations.Track(),
-                TestConfigurations.StreamGateway("https://stream.musify.test"));
+                TestConfigurations.StreamGateway("https://stream.musify.test"),
+                playback ?? TestConfigurations.Playback());
 
-            return new GetTrackStreamQueryHandler(Database, issuer, NoOpLogger<GetTrackStreamQueryHandler>());
+            return new GetTrackStreamQueryHandler(Database, issuer, playback ?? TestConfigurations.Playback(), NoOpLogger<GetTrackStreamQueryHandler>());
         }
 
         [Fact]
@@ -64,5 +66,35 @@ namespace Musify.Application.Tests.Tracks
 
             Assert.Equal(ErrorType.Conflict, result.FirstError.Type);
         }
+
+        [Fact]
+        public async Task Handle_AnonymousUser_AnonymousListeningDisabled_ReturnsUnauthorized()
+        {
+            var owner = TestEntities.User();
+            var track = TestEntities.LocalTrack(owner);
+            await SeedAsync(owner, track);
+
+            var handler = CreateHandler(TestConfigurations.Playback(allowAnonymousListening: false));
+
+            var result = await handler.Handle(new GetTrackStreamQuery(track.Id, UserId: null), TestContext.Current.CancellationToken);
+
+            Assert.Equal(ErrorType.Unauthorized, result.FirstError.Type);
+        }
+
+        [Fact]
+        public async Task Handle_AnonymousUser_AnonymousListeningEnabled_IssuesTicketWithoutRecordingHistory()
+        {
+            var owner = TestEntities.User();
+            var track = TestEntities.LocalTrack(owner);
+            await SeedAsync(owner, track);
+
+            var handler = CreateHandler(TestConfigurations.Playback(allowAnonymousListening: true));
+
+            var result = await handler.Handle(new GetTrackStreamQuery(track.Id, UserId: null), TestContext.Current.CancellationToken);
+
+            Assert.False(result.IsError);
+            Assert.Equal("ticket-token", result.Value.Ticket);
+            Assert.Empty(await Database.ListeningHistories.ToListAsync(TestContext.Current.CancellationToken));
+        }
     }
 }