Store each client's play queue in the database

The queue lived in memory and was shared by all clients, so a restart or a
finished sync cleared it. Every client now has its own queue in the new
queue and queue_song tables (added to the undeployed migration 000006).

The music endpoints return the queue ID in the X-Queue-Id header and expect
it back. A request without an ID, or with an ended one, starts a new queue.
/music/reset ends the queue and returns a new ID, and a sync ends all
running queues. Ended queues are kept as history.

The deprecated legacy routes without the /api/v1 prefix are removed.

internal/server/token_handler.go

@@ -55,7 +55,7 @@ func (s *Server) passwordValid(password string) bool {
 	return subtle.ConstantTimeCompare([]byte(password), []byte(s.cfg.APIPassword)) == 1
 }
 
-func (s *Server) registerToken(a apis) {
+func (s *Server) registerToken(a huma.API) {
 	create := huma.Operation{
 		OperationID: "create-token",
 		Method:      http.MethodPost,
@@ -65,7 +65,7 @@ func (s *Server) registerToken(a apis) {
 			"Requires the API password when the server has one. Limited to 10 requests per minute per client.",
 		Tags:        []string{"auth"},
 		Errors:      []int{http.StatusUnauthorized, http.StatusTooManyRequests},
-		Middlewares: huma.Middlewares{middleware.RateLimit(a.v1, 10, time.Minute)},
+		Middlewares: huma.Middlewares{middleware.RateLimit(a, 10, time.Minute)},
 	}
 	register(s, a, route{op: create, public: true},
 		func(ctx context.Context, in *tokenInput) (*jsonBody[TokenResponse], error) {