refactor(api)!: remove the shared operator secret, and let hosts sync their own

A single secret that turned any request into an operator was the only
credential several routes accepted, and it had no caller left: the device
pairing it existed for is on hold, and nothing in this tree or any client
sent it. What remained was a key that bypassed authentication entirely,
required to boot, and checked by nobody.

Every route behind it had a better answer available:

- Library and game sync move to host credentials. Both took a `userId` in
  the body, which meant one secret could write into anybody's library. A
  host now says which of its enrolled users a batch is for, and that claim
  is checked against the Steam sign-ins it actually holds — one box carries
  several people's accounts, so the pair is the unit.
- Download-state reporting narrows to hosts alone, and the body that could
  name a different host is gone. Which host is reporting comes from its own
  credentials, and a body that still names one is refused rather than
  ignored.
- Linking a Steam account is always for the caller.
- Creating a game by hand is deleted; syncing already upserts the catalogue.
- Reading the waitlist is deleted. Every address on it belongs to someone
  who has not agreed to anything, and answering it over HTTP made that list
  something a leaked key could drain.
- The pairing-code routes are deleted with the flow they served. The domain
  module and its table stay, so returning to it is a route file rather than
  a migration.

Nothing in the API now accepts a credential that stands for more than one
caller: every request resolves to a specific user or a specific host, which
is what lets a route say "the caller's own library" and mean it.

BREAKING CHANGE: the `x-nestri-admin-token` header is no longer accepted and
`ADMIN_SHARED_SECRET` is no longer read. `POST /games`, `GET /waitlist` and
the `/pairing-code` routes are gone; `POST /games/sync` and `POST /library/sync`
now require host credentials and take `userId` in the body; `POST /steam/link`
no longer accepts `userId`; `POST /games/download-state` no longer accepts
`hostId`.

apps/api/test/enrolment.test.ts

@@ -1,18 +1,37 @@
 import { afterAll, describe, expect, test } from 'bun:test';
 
+import { AccessToken } from '@nestri/core/access-token/index';
 import { Fixtures } from '@nestri/core/db/fixtures';
 import { testDb } from '@nestri/core/db/test';
 import { Identifier } from '@nestri/core/id';
 import { Machine } from '@nestri/core/machine/index';
 
 import { app } from '../app/index';
-import { TEST_ADMIN_SECRET } from './setup';
 import './setup';
 
 const sql = testDb();
 
 const createdUserIds: string[] = [];
 
+/**
+ * A signed-in person, as a personal access token.
+ *
+ * The tests below use it to prove `machineOnly` refuses a human: it needs a
+ * caller who is authenticated and is not a host, and a user session is the
+ * only kind there is.
+ */
+async function signedInHeaders(label: string): Promise<Record<string, string>> {
+	const owner = await Fixtures.owner(label);
+	createdUserIds.push(owner.userId);
+	const pat = await AccessToken.create({
+		id: Identifier.ascending('accessToken'),
+		ownerUserId: owner.userId,
+		teamId: null,
+		name: label
+	});
+	return { authorization: `Bearer ${pat.token}` };
+}
+
 /** A Steam ID is 17 digits; these are distinct and obviously not real. */
 function steamId(n: number) {
 	return `765611980000${String(n).padStart(5, '0')}`;
@@ -185,7 +204,10 @@ describe('POST /machine/enrolment', () => {
 	test('machine credentials are required', async () => {
 		const res = await app.request('/machine/enrolment', {
 			method: 'POST',
-			headers: { 'x-nestri-admin-token': TEST_ADMIN_SECRET, 'content-type': 'application/json' },
+			headers: {
+				...(await signedInHeaders('enrol-nomachine')),
+				'content-type': 'application/json'
+			},
 			body: JSON.stringify({ userId: Identifier.ascending('user'), steamId: steamId(7) })
 		});
 		expect(res.status).toBe(403);
@@ -240,7 +262,10 @@ describe('POST /machine/enrolment/stale', () => {
 	test('machine credentials are required', async () => {
 		const res = await app.request('/machine/enrolment/stale', {
 			method: 'POST',
-			headers: { 'x-nestri-admin-token': TEST_ADMIN_SECRET, 'content-type': 'application/json' },
+			headers: {
+				...(await signedInHeaders('stale-nomachine')),
+				'content-type': 'application/json'
+			},
 			body: JSON.stringify({ userId: Identifier.ascending('user') })
 		});
 		expect(res.status).toBe(403);
@@ -272,7 +297,7 @@ describe('GET /machine/enrolment', () => {
 
 	test('machine credentials are required', async () => {
 		const res = await app.request('/machine/enrolment', {
-			headers: { 'x-nestri-admin-token': TEST_ADMIN_SECRET }
+			headers: await signedInHeaders('list-nomachine')
 		});
 		expect(res.status).toBe(403);
 	});