refactor(web): break auth ↔ player import cycle via session-end signal (#375)

auth/store.svelte.ts no longer imports from $lib/player. Logout
broadcasts via auth/sessionEnd.svelte.ts (a tiny tick + outgoing
userId pair); player subscribes through $effect.root and owns the
player-specific teardown (clearPersistedQueue + playQueue([]) +
closeQueueDrawer()).

Cycle fully inverted — auth is now a pure leaf for player; future
session-end consumers (download cache, recent-search history) plug
in by adding their own effect on the same signal.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/src/lib/auth/store.svelte.ts

@@ -1,7 +1,6 @@
 import { api, type User, type LoginResponse } from '$lib/api/client';
 import { queryClient } from '$lib/query/client';
-import { clearPersistedQueue } from '$lib/player/persisted';
-import { playQueue, closeQueueDrawer } from '$lib/player/store.svelte';
+import { signalSessionEnd } from './sessionEnd.svelte';
 import { user, setUser } from './user.svelte';
 
 // Re-export so existing `import { user } from '$lib/auth/store.svelte'`
@@ -55,11 +54,7 @@ export async function logout(opts: { silent?: boolean } = {}): Promise<void> {
       // best effort — server-side session may already be gone
     }
   }
+  signalSessionEnd(userId ?? null);
   setUser(null);
   queryClient.clear();
-  // M7 #364: clear queue persistence + reset in-memory queue + close drawer
-  // so a subsequent login doesn't inherit the previous user's playback state.
-  if (userId) clearPersistedQueue(userId);
-  playQueue([]);
-  closeQueueDrawer();
 }