refactor(api)!: remove the shared operator secret, and let hosts sync their own

A single secret that turned any request into an operator was the only
credential several routes accepted, and it had no caller left: the device
pairing it existed for is on hold, and nothing in this tree or any client
sent it. What remained was a key that bypassed authentication entirely,
required to boot, and checked by nobody.

Every route behind it had a better answer available:

- Library and game sync move to host credentials. Both took a `userId` in
  the body, which meant one secret could write into anybody's library. A
  host now says which of its enrolled users a batch is for, and that claim
  is checked against the Steam sign-ins it actually holds — one box carries
  several people's accounts, so the pair is the unit.
- Download-state reporting narrows to hosts alone, and the body that could
  name a different host is gone. Which host is reporting comes from its own
  credentials, and a body that still names one is refused rather than
  ignored.
- Linking a Steam account is always for the caller.
- Creating a game by hand is deleted; syncing already upserts the catalogue.
- Reading the waitlist is deleted. Every address on it belongs to someone
  who has not agreed to anything, and answering it over HTTP made that list
  something a leaked key could drain.
- The pairing-code routes are deleted with the flow they served. The domain
  module and its table stay, so returning to it is a route file rather than
  a migration.

Nothing in the API now accepts a credential that stands for more than one
caller: every request resolves to a specific user or a specific host, which
is what lets a route say "the caller's own library" and mean it.

BREAKING CHANGE: the `x-nestri-admin-token` header is no longer accepted and
`ADMIN_SHARED_SECRET` is no longer read. `POST /games`, `GET /waitlist` and
the `/pairing-code` routes are gone; `POST /games/sync` and `POST /library/sync`
now require host credentials and take `userId` in the body; `POST /steam/link`
no longer accepts `userId`; `POST /games/download-state` no longer accepts
`hostId`.

apps/api/app/utils/auth.ts

@@ -1 +1 @@
-export { auth, notPublic, adminOnly, machineOnly, machineOrAdmin } from '../middleware/auth.js';
+export { auth, notPublic, machineOnly } from '../middleware/auth.js';

apps/api/app/utils/enrolment.ts

@@ -0,0 +1,32 @@
+import { Actor } from '@nestri/core/actor';
+import { ErrorCodes, VisibleError } from '@nestri/core/error';
+import { Enrolment } from '@nestri/core/steam/enrolment';
+
+/**
+ * The user a host is allowed to speak about, or a refusal.
+ *
+ * One box carries several people's Steam sign-ins, so which user a batch
+ * belongs to has to be said rather than inferred from the credentials — and
+ * then checked, because a body field naming a user is otherwise a way to write
+ * into any library. The enrolment record is what it is checked against:
+ * holding a refresh token is what lets a host enumerate those games at all, so
+ * a host without one is reporting something it could not have observed.
+ *
+ * Shared by the two sync routes deliberately. The check is the whole boundary
+ * between "a host reporting what it can see" and "a host writing wherever it
+ * likes", and two copies of it are two things to keep in agreement.
+ */
+export async function enrolledUser(userId: string): Promise<string> {
+	const enrolment = await Enrolment.findByMachineAndUser({
+		machineId: Actor.machineID,
+		userId
+	});
+	if (!enrolment) {
+		throw new VisibleError(
+			'forbidden',
+			ErrorCodes.Permission.FORBIDDEN,
+			'This host holds no Steam sign-in for that user'
+		);
+	}
+	return userId;
+}

apps/api/app/utils/index.ts

@@ -1,4 +1,5 @@
 export * from './auth';
+export * from './enrolment';
 export * from './error';
 export * from './result';
 export * from './validator';