Add anonymous playback with an optional Spotify-style preview cap

New Playback:AllowAnonymousListening / Playback:AnonymousFragmentSeconds
settings control whether a request without a session can stream at all,
and if so, whether it's limited to a fragment instead of the full track:

- GET /tracks/{id}/stream and GET /youtube/tracks/{videoId}/stream no
  longer require authorization outright; the handlers gate on the config
  instead, so both keep working exactly as before when it's off (the
  default).
- The fragment cap is enforced by the Streaming Gateway, not the client:
  the stream ticket now carries an optional maxBytes claim (computed from
  AnonymousFragmentSeconds and the transcoder's known bitrate), and
  TicketValidationMiddleware clamps the Range it forwards to SeaweedFS to
  stay under it — synthesizing one if the request didn't send one, and
  answering 416 outright if the requested range starts past the cap.
- A YouTube track that hasn't been provisioned server-side yet streams
  straight from YouTube's CDN, bypassing the Gateway entirely — there's no
  way to cap that, so an anonymous request for one is refused (409) instead
  of silently handing out an uncapped stream.
- ListeningHistory has a non-nullable UserId, so anonymous plays simply
  don't get recorded rather than trying to force a row through the FK.

Also fixes a real, pre-existing bug this surfaced: the AppSettings.Development.json
of the Api, Worker, and StreamingGateway all pointed StreamTicket/Workers
paths at "../../deploy/..." — one directory short of deploy/'s actual
location at the repo root relative to each project's own folder. Docker
never hit this (it mounts an absolute /keys path), so it had apparently
never been exercised via `dotnet run` before.

backend/Tests/Musify.StreamingGateway.Tests/Middleware/TicketValidationMiddlewareTests.cs

@@ -36,15 +36,22 @@ namespace Musify.StreamingGateway.Tests.Middleware
             File.Delete(publicKeyPath);
         }
 
-        private string IssueValidToken(string prefix = Prefix) => new JsonWebTokenHandler().CreateToken(new SecurityTokenDescriptor
+        private string IssueValidToken(string prefix = Prefix, long? maxBytes = null)
         {
-            Issuer = options.Issuer,
-            Audience = options.Audience,
-            NotBefore = DateTime.UtcNow.AddMinutes(-1),
-            Expires = DateTime.UtcNow.AddMinutes(5),
-            Claims = new Dictionary<string, object> { ["prefix"] = prefix },
-            SigningCredentials = new SigningCredentials(new RsaSecurityKey(rsa), SecurityAlgorithms.RsaSha256),
-        });
+            var claims = new Dictionary<string, object> { ["prefix"] = prefix };
+            if (maxBytes is not null)
+                claims["maxBytes"] = maxBytes.Value.ToString();
+
+            return new JsonWebTokenHandler().CreateToken(new SecurityTokenDescriptor
+            {
+                Issuer = options.Issuer,
+                Audience = options.Audience,
+                NotBefore = DateTime.UtcNow.AddMinutes(-1),
+                Expires = DateTime.UtcNow.AddMinutes(5),
+                Claims = claims,
+                SigningCredentials = new SigningCredentials(new RsaSecurityKey(rsa), SecurityAlgorithms.RsaSha256),
+            });
+        }
 
         private (TicketValidationMiddleware Middleware, Func<bool> WasNextCalled) CreateMiddleware()
         {
@@ -150,5 +157,64 @@ namespace Musify.StreamingGateway.Tests.Middleware
 
             Assert.True(wasNextCalled());
         }
+
+        [Fact]
+        public async Task InvokeAsync_TicketWithMaxBytes_NoRangeRequested_SynthesizesABoundedRange()
+        {
+            var (middleware, wasNextCalled) = CreateMiddleware();
+            var context = new DefaultHttpContext();
+            context.Request.Path = $"/media/{Prefix}/audio.m4a";
+            context.Request.QueryString = new QueryString($"?t={IssueValidToken(maxBytes: 480_000)}");
+
+            await middleware.InvokeAsync(context);
+
+            Assert.True(wasNextCalled());
+            Assert.Equal("bytes=0-479999", context.Request.Headers.Range.ToString());
+        }
+
+        [Fact]
+        public async Task InvokeAsync_TicketWithMaxBytes_RangeWithinCap_ClampsTheEndOnly()
+        {
+            var (middleware, wasNextCalled) = CreateMiddleware();
+            var context = new DefaultHttpContext();
+            context.Request.Path = $"/media/{Prefix}/audio.m4a";
+            context.Request.QueryString = new QueryString($"?t={IssueValidToken(maxBytes: 480_000)}");
+            context.Request.Headers.Range = "bytes=1000-";
+
+            await middleware.InvokeAsync(context);
+
+            Assert.True(wasNextCalled());
+            Assert.Equal("bytes=1000-479999", context.Request.Headers.Range.ToString());
+        }
+
+        [Fact]
+        public async Task InvokeAsync_TicketWithMaxBytes_RangeStartsAtOrPastTheCap_ReturnsRangeNotSatisfiable()
+        {
+            var (middleware, wasNextCalled) = CreateMiddleware();
+            var context = new DefaultHttpContext();
+            context.Request.Path = $"/media/{Prefix}/audio.m4a";
+            context.Request.QueryString = new QueryString($"?t={IssueValidToken(maxBytes: 480_000)}");
+            context.Request.Headers.Range = "bytes=480000-";
+
+            await middleware.InvokeAsync(context);
+
+            Assert.False(wasNextCalled());
+            Assert.Equal(StatusCodes.Status416RangeNotSatisfiable, context.Response.StatusCode);
+        }
+
+        [Fact]
+        public async Task InvokeAsync_TicketWithoutMaxBytes_LeavesTheRequestedRangeUntouched()
+        {
+            var (middleware, wasNextCalled) = CreateMiddleware();
+            var context = new DefaultHttpContext();
+            context.Request.Path = $"/media/{Prefix}/audio.m4a";
+            context.Request.QueryString = new QueryString($"?t={IssueValidToken()}");
+            context.Request.Headers.Range = "bytes=1000-2000";
+
+            await middleware.InvokeAsync(context);
+
+            Assert.True(wasNextCalled());
+            Assert.Equal("bytes=1000-2000", context.Request.Headers.Range.ToString());
+        }
     }
 }