fix(web): guard authenticated routes instead of asserting the session user

library, playlists and playlists/[id] read locals.user!.sub with no
check, so an anonymous request threw a TypeError and returned 500
instead of redirecting to login. Adds requireUser(), which redirects to
/login?returnTo=... and returns a non-null SessionUser, and drops the
five non-null assertions.

/upload had no load at all: the page rendered for anonymous users and
only failed on submit. It now redirects up front.

frontend/src/routes/(app)/upload/+page.server.ts

@@ -1,10 +1,19 @@
-import type { Actions } from './$types';
+import type { Actions, PageServerLoad } from './$types';
 import { fail } from '@sveltejs/kit';
-import { createApiClient, requireAccessTokenAction, unwrapOrFail } from '$lib/server/api';
+import {
+	createApiClient,
+	requireAccessTokenAction,
+	requireUser,
+	unwrapOrFail
+} from '$lib/server/api';
 import { putPresigned, extOf, contentTypeOf, AUDIO_TYPES, IMAGE_TYPES } from '$lib/server/upload';
 
 const MAX_TITLE = 100;
 
+export const load: PageServerLoad = ({ locals, url }) => {
+	requireUser(locals, url);
+};
+
 export const actions: Actions = {
 	default: async ({ request, locals, fetch }) => {
 		const accessToken = requireAccessTokenAction(locals, 'Inicia sesión para subir música.');