music: self-hosted scrobbler (Spotify poller, Last.fm + streaming-history importers, /trackers/music, homepage listening card)

- music schema: artists/albums/tracks (+album art), plays with source + dedupe, now_playing,
  spotify_auth, import_state; plays_deduped view hides Last.fm scrobbles Spotify also has
- in-app Spotify poller (60s, leased) started from hooks init; no new role or env needed
- /api/spotify/connect + callback (owner only), /trackers/music public stats
- scripts: music-poll, music-import-lastfm (resumable), music-import-history
- deploy/music-collector: optional host timer with its own role

src/lib/server/owner.ts

@@ -26,7 +26,9 @@ export const ownerOnlyPrefixes = [
 	'/trackers/groceries',
 	'/trackers/houses',
 	'/trackers/books/files',
-	'/lists/db'
+	'/lists/db',
+	// Spotify OAuth for the listening tracker (connect + callback 404 for everyone else).
+	'/api/spotify'
 ] as const;
 
 /**
@@ -46,7 +48,8 @@ export const ownerWritePrefixes = [
 	'/trackers/groceries',
 	'/trackers/houses',
 	'/trackers/books',
-	'/trackers/cars'
+	'/trackers/cars',
+	'/trackers/music'
 ] as const;
 
 const normalise = (pathname: string) => pathname.toLowerCase().replace(/\/+$/, '');