feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

users.api_token held each user's apiKey in plaintext and was looked up by
equality, so a leaked row or backup handed out working keys. Migration
0063 replaces it with api_token_hash (sha256, hex), computed in place
from the existing keys so every Subsonic client keeps working.

The key can no longer be read back: GET /api/me/api-token is gone, and
POST returns the new key once. Settings shows it right after Regenerate
with a copy button and a "won't be shown again" note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/library/duplicate_merge_test.go

@@ -74,7 +74,7 @@ func newMergeFixture(t *testing.T) mergeFixture {
 	user := func(name string) dbq.User {
 		t.Helper()
 		u, err := q.CreateUser(ctx, dbq.CreateUserParams{
-			Username: dbtest.TestUserPrefix + name, PasswordHash: "x", ApiToken: name + "-merge-token",
+			Username: dbtest.TestUserPrefix + name, PasswordHash: "x", ApiTokenHash: name + "-merge-token",
 		})
 		if err != nil {
 			t.Fatalf("user %s: %v", name, err)