feat(auth): library sync over HTTP for the website player; docs without Zen

[scobru]

Summary

• New GET / PUT /api/auth/zen/library/:pub and public GET /api/auth/zen/library/:pub/shared/:id: cross-device sync of a listener's favorites, artists and playlists, plus shared playlists. Replaces the Zen relay the website player used, so no relay is left anywhere.
• Auth is a signature, not a session: X-Fid-Auth: <ts>.<sig> over fid-library:<METHOD>:<path>:<ts>:<sha256(body)>, 5-minute window. The key must belong to an active account on the instance (admin.zen_pub), so an instance is not free storage for strangers.
• Records are opaque to the server (encrypted in the browser); shared is stored in the clear on purpose. Last write wins by the record's own timestamp, deletes are tombstones.
• Limits: 200 records/request, 64 KB/record, 5000 records and 8 MB per identity, 120 req/min per IP (413 over the cap). New table library_sync.
• CORS: wildcard origin without credentials for this prefix only (the signature is the credential); requests carrying cookies or Authorization keep strict CORS.
• Docs (EN + IT): FID identity, architecture, federation, decisions, roles, collab and others now describe Ed25519 identities and the library sync, not Zen SEA or a relay. Removed the dead zen / @akaoio/zen type stubs from the webapp. Version 6.2.0.

Test plan

• npx jest: 201 suites / 2589 tests pass (7 new, covering round trip, last-write-wins, tombstones, forged / tampered / stale signatures, non-account keys, size limits, public shared playlists).
• tsc --noEmit clean for server and webapp.
• Companion change in tunecamp-website (player and identity pages) is the client of these endpoints.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FeCp9YZh9dCEHXtRdpVeFe

---

Generated by Claude Code