refactor(api)!: remove the shared operator secret, and let hosts sync their own

A single secret that turned any request into an operator was the only
credential several routes accepted, and it had no caller left: the device
pairing it existed for is on hold, and nothing in this tree or any client
sent it. What remained was a key that bypassed authentication entirely,
required to boot, and checked by nobody.

Every route behind it had a better answer available:

- Library and game sync move to host credentials. Both took a `userId` in
  the body, which meant one secret could write into anybody's library. A
  host now says which of its enrolled users a batch is for, and that claim
  is checked against the Steam sign-ins it actually holds — one box carries
  several people's accounts, so the pair is the unit.
- Download-state reporting narrows to hosts alone, and the body that could
  name a different host is gone. Which host is reporting comes from its own
  credentials, and a body that still names one is refused rather than
  ignored.
- Linking a Steam account is always for the caller.
- Creating a game by hand is deleted; syncing already upserts the catalogue.
- Reading the waitlist is deleted. Every address on it belongs to someone
  who has not agreed to anything, and answering it over HTTP made that list
  something a leaked key could drain.
- The pairing-code routes are deleted with the flow they served. The domain
  module and its table stay, so returning to it is a route file rather than
  a migration.

Nothing in the API now accepts a credential that stands for more than one
caller: every request resolves to a specific user or a specific host, which
is what lets a route say "the caller's own library" and mean it.

BREAKING CHANGE: the `x-nestri-admin-token` header is no longer accepted and
`ADMIN_SHARED_SECRET` is no longer read. `POST /games`, `GET /waitlist` and
the `/pairing-code` routes are gone; `POST /games/sync` and `POST /library/sync`
now require host credentials and take `userId` in the body; `POST /steam/link`
no longer accepts `userId`; `POST /games/download-state` no longer accepts
`hostId`.

apps/api/app/routes/library.ts

@@ -8,7 +8,7 @@ import { Hono } from 'hono';
 import { describeRoute } from 'hono-openapi';
 import { z } from 'zod';
 
-import { ErrorResponses, adminOnly, notPublic, Result, validator } from '../utils';
+import { enrolledUser, ErrorResponses, machineOnly, notPublic, Result, validator } from '../utils';
 
 export namespace LibraryApi {
 	export const route = new Hono()
@@ -56,12 +56,12 @@ export namespace LibraryApi {
 		)
 		.post(
 			'/sync',
-			adminOnly,
+			machineOnly,
 			describeRoute({
 				tags: ['Library'],
 				summary: "Sync a user's Steam library",
 				description:
-					'Batch upsert games and library entries for a user from Steam owned games data. Admin only.',
+					'Batch upsert games and library entries from Steam owned games data. The library synced is the caller\u2019s own; there is no field for naming another user.',
 				responses: {
 					200: {
 						content: {
@@ -86,7 +86,7 @@ export namespace LibraryApi {
 				'json',
 				z.object({
 					userId: z.string().meta({
-						description: 'The user to sync library for',
+						description: 'Which of the host\u2019s enrolled users this library belongs to',
 						example: Examples.User.id
 					}),
 					games: z
@@ -121,7 +121,8 @@ export namespace LibraryApi {
 				})
 			),
 			async (c) => {
-				const { userId, games } = c.req.valid('json');
+				const { games } = c.req.valid('json');
+				const userId = await enrolledUser(c.req.valid('json').userId);
 
 				const existingGames = await Game.listByAppIDs(games.map((g) => g.steamAppId));
 				const existingByAppId = new Map(existingGames.map((g) => [g.steamAppId, g]));