feat(api): add GET/PUT /api/me/listenbrainz endpoints

Exposes user ListenBrainz config (token_set bool, enabled, last_scrobbled_at)
via write-only token semantics; enforces no-enable-without-token at the API layer.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/db/dbq/users.sql.go

@@ -61,7 +61,7 @@ const getListenBrainzConfig = `-- name: GetListenBrainzConfig :one
 SELECT
     u.listenbrainz_token,
     u.listenbrainz_enabled,
-    (SELECT MAX(pe.scrobbled_at)
+    (SELECT MAX(pe.scrobbled_at)::timestamptz
      FROM play_events pe
      WHERE pe.user_id = u.id) AS last_scrobbled_at
 FROM users u
@@ -71,7 +71,7 @@ WHERE u.id = $1
 type GetListenBrainzConfigRow struct {
 	ListenbrainzToken   *string
 	ListenbrainzEnabled bool
-	LastScrobbledAt     interface{}
+	LastScrobbledAt     pgtype.Timestamptz
 }
 
 // Returns the user's LB token + enabled flag and the most recent