refactor: rename frontend/ to web-player/ and format with prettier

Updates the compose build context, the Dockerfile header, the package
name and the docs. The compose service and container keep the name
frontend/musify-frontend, since nginx routes to http://frontend:3000.

The source files also carry the first prettier pass, so the rename and
the reformat land together for them.

web-player/src/routes/auth/callback/+server.ts

@@ -0,0 +1,65 @@
+import { redirect, error } from '@sveltejs/kit';
+import * as client from 'openid-client';
+import type { RequestHandler } from './$types';
+import {
+	getOidcConfig,
+	encodeSession,
+	sessionCookieOptions,
+	toSessionUser,
+	type Session,
+	SESSION_COOKIE,
+	STATE_COOKIE,
+	VERIFIER_COOKIE,
+	NONCE_COOKIE,
+	RETURN_COOKIE
+} from '$lib/server/auth';
+
+export const GET: RequestHandler = async ({ url, cookies }) => {
+	const codeVerifier = cookies.get(VERIFIER_COOKIE);
+	const state = cookies.get(STATE_COOKIE);
+	const nonce = cookies.get(NONCE_COOKIE);
+	const returnTo = cookies.get(RETURN_COOKIE) ?? '/';
+
+	if (!codeVerifier || !state) {
+		error(400, 'Estado de autenticación inválido. Vuelve a iniciar sesión.');
+	}
+
+	const config = await getOidcConfig();
+
+	let tokens;
+	try {
+		tokens = await client.authorizationCodeGrant(config, url, {
+			pkceCodeVerifier: codeVerifier,
+			expectedState: state,
+			expectedNonce: nonce,
+			idTokenExpected: true
+		});
+	} catch (exception) {
+		console.error('Token exchange failed', exception);
+		error(401, 'La autenticación ha fallado.');
+	}
+
+	const claims = tokens.claims();
+	if (!claims || !tokens.id_token) {
+		error(401, 'El proveedor no devolvió el token de identidad.');
+	}
+	if (!tokens.refresh_token) {
+		error(401, 'El proveedor no devolvió un refresh token; revisa el scope offline_access.');
+	}
+
+	const session: Session = {
+		...toSessionUser(claims),
+		accessToken: tokens.access_token,
+		refreshToken: tokens.refresh_token,
+		idToken: tokens.id_token,
+		expiresAt: Math.floor(Date.now() / 1000) + (tokens.expires_in ?? 3600)
+	};
+
+	cookies.set(SESSION_COOKIE, await encodeSession(session), sessionCookieOptions(url));
+
+	for (const name of [STATE_COOKIE, VERIFIER_COOKIE, NONCE_COOKIE, RETURN_COOKIE]) {
+		cookies.delete(name, { path: '/' });
+	}
+
+	redirect(302, returnTo);
+};

web-player/src/routes/auth/login/+server.ts

@@ -0,0 +1,49 @@
+import { redirect } from '@sveltejs/kit';
+import * as client from 'openid-client';
+import type { RequestHandler } from './$types';
+import {
+	getOidcConfig,
+	STATE_COOKIE,
+	VERIFIER_COOKIE,
+	NONCE_COOKIE,
+	RETURN_COOKIE
+} from '$lib/server/auth';
+import { authConfig } from '$lib/server/config';
+
+export const GET: RequestHandler = async ({ url, cookies }) => {
+	const config = await getOidcConfig();
+
+	const codeVerifier = client.randomPKCECodeVerifier();
+	const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
+	const state = client.randomState();
+	const nonce = client.randomNonce();
+
+	const register = url.searchParams.get('mode') === 'register';
+	const returnTo = url.searchParams.get('returnTo') ?? '/';
+
+	const parameters: Record<string, string> = {
+		redirect_uri: authConfig.redirectUri,
+		scope: authConfig.scope,
+		code_challenge: codeChallenge,
+		code_challenge_method: 'S256',
+		state,
+		nonce
+	};
+	if (register) parameters.prompt = 'create';
+
+	const authorizationUrl = client.buildAuthorizationUrl(config, parameters);
+
+	const cookieOptions = {
+		httpOnly: true,
+		sameSite: 'lax' as const,
+		secure: url.protocol === 'https:',
+		path: '/',
+		maxAge: authConfig.flowTtlSeconds
+	};
+	cookies.set(VERIFIER_COOKIE, codeVerifier, cookieOptions);
+	cookies.set(STATE_COOKIE, state, cookieOptions);
+	cookies.set(NONCE_COOKIE, nonce, cookieOptions);
+	cookies.set(RETURN_COOKIE, returnTo, cookieOptions);
+
+	redirect(302, authorizationUrl.href);
+};