fix(subsonic): getUser answers an admin's lookup with the requested user (#6292)

An admin asking for another username got their own name and roles back.
The handler now looks the user up by exact username and answers with
that user's payload; an unknown username is ErrDataNotFound. A
non-admin asking about someone else is still ErrNotAuthorized.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/subsonic/subsonic.go

@@ -13,6 +13,7 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
+	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/playevents"
 )
 
@@ -26,6 +27,7 @@ import (
 func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, cfg Config, events *playevents.Writer, hops func() int) {
 	b := &browseHandlers{pool: pool}
 	m := newMediaHandlers(pool, events, logger)
+	u := &userHandlers{lookup: dbq.New(pool).GetUserByUsername}
 	r.Route("/rest", func(sub chi.Router) {
 		sub.Use(Middleware(pool, cfg, auth.NewLoginGuard(), hops))
 		register(sub, "/ping", handlePing)
@@ -46,7 +48,7 @@ func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, cfg Config, ev
 		register(sub, "/unstar", m.handleUnstar)
 		register(sub, "/getStarred", m.handleGetStarred)
 		register(sub, "/getStarred2", m.handleGetStarred2)
-		register(sub, "/getUser", handleGetUser)
+		register(sub, "/getUser", u.getUser)
 
 		// Subsonic clients expect every /rest/* miss to come back as a
 		// Subsonic-shaped error envelope, not chi's plain-text 404. Without