refactor(api)!: remove the shared operator secret, and let hosts sync their own

A single secret that turned any request into an operator was the only
credential several routes accepted, and it had no caller left: the device
pairing it existed for is on hold, and nothing in this tree or any client
sent it. What remained was a key that bypassed authentication entirely,
required to boot, and checked by nobody.

Every route behind it had a better answer available:

- Library and game sync move to host credentials. Both took a `userId` in
  the body, which meant one secret could write into anybody's library. A
  host now says which of its enrolled users a batch is for, and that claim
  is checked against the Steam sign-ins it actually holds — one box carries
  several people's accounts, so the pair is the unit.
- Download-state reporting narrows to hosts alone, and the body that could
  name a different host is gone. Which host is reporting comes from its own
  credentials, and a body that still names one is refused rather than
  ignored.
- Linking a Steam account is always for the caller.
- Creating a game by hand is deleted; syncing already upserts the catalogue.
- Reading the waitlist is deleted. Every address on it belongs to someone
  who has not agreed to anything, and answering it over HTTP made that list
  something a leaked key could drain.
- The pairing-code routes are deleted with the flow they served. The domain
  module and its table stay, so returning to it is a route file rather than
  a migration.

Nothing in the API now accepts a credential that stands for more than one
caller: every request resolves to a specific user or a specific host, which
is what lets a route say "the caller's own library" and mean it.

BREAKING CHANGE: the `x-nestri-admin-token` header is no longer accepted and
`ADMIN_SHARED_SECRET` is no longer read. `POST /games`, `GET /waitlist` and
the `/pairing-code` routes are gone; `POST /games/sync` and `POST /library/sync`
now require host credentials and take `userId` in the body; `POST /steam/link`
no longer accepts `userId`; `POST /games/download-state` no longer accepts
`hostId`.

docs/deploy.md

@@ -89,15 +89,11 @@ cd apps/auth
 bunx wrangler secret put EMAIL_SEND_URL --env production
 bunx wrangler secret put EMAIL_API_KEY  --env production
 bunx wrangler secret put EMAIL_FROM     --env production
-
-cd ../api
-bunx wrangler secret put ADMIN_SHARED_SECRET --env production
 ```
 
-`ADMIN_SHARED_SECRET` turns any request carrying it into an operator, so
-generate it rather than choosing it — `openssl rand -hex 32` — and never give
-it a default anywhere. What it is for is listed in
-[`apps/api/README.md`](../apps/api/README.md).
+The API has no secrets of its own to put here: every caller it accepts proves
+who it is — a session token from the issuer, a personal access token, or a
+registered host's own credentials — so there is nothing shared to leak.
 
 The issuer refuses to send a sign-in code with its mail settings half
 configured or absent, rather than falling back to printing codes to the log —
@@ -139,7 +135,6 @@ Both images are stateless and hold no configuration. What they need:
 | `AUTH_INTERNAL_URL` | — | only if that URL is unroutable from here |
 | `EMAIL_SEND_URL` `EMAIL_API_KEY` `EMAIL_FROM` | all three, or none | — |
 | `EMAIL_DEV_LOG` | `true` prints codes instead of sending | — |
-| `ADMIN_SHARED_SECRET` | — | required; operator access |
 | `PORT` | default `1337` | default `3000` |
 
 [`docker-compose.yml`](../docker-compose.yml) at the root wires all of it