refactor(web): break auth ↔ player import cycle via session-end signal (#375)

auth/store.svelte.ts no longer imports from $lib/player. Logout
broadcasts via auth/sessionEnd.svelte.ts (a tiny tick + outgoing
userId pair); player subscribes through $effect.root and owns the
player-specific teardown (clearPersistedQueue + playQueue([]) +
closeQueueDrawer()).

Cycle fully inverted — auth is now a pure leaf for player; future
session-end consumers (download cache, recent-search history) plug
in by adding their own effect on the same signal.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/src/lib/player/store.svelte.ts

@@ -2,7 +2,8 @@ import type { TrackRef, RadioResponse } from '$lib/api/types';
 import { untrack } from 'svelte';
 import { api } from '$lib/api/client';
 import { user } from '$lib/auth/user.svelte';
-import { readPersistedQueue, writePersistedQueue } from './persisted';
+import { sessionEnd } from '$lib/auth/sessionEnd.svelte';
+import { readPersistedQueue, writePersistedQueue, clearPersistedQueue } from './persisted';
 
 export type PlayerState = 'idle' | 'loading' | 'playing' | 'paused' | 'error';
 export type RepeatMode = 'off' | 'all' | 'one';
@@ -385,6 +386,22 @@ $effect.root(() => {
   });
 });
 
+// Session-end teardown (#375): auth signals via sessionEnd; player
+// owns the player-specific cleanup (clear persisted queue for the
+// outgoing user, reset in-memory queue, close drawer) without auth
+// having to import any player APIs.
+$effect.root(() => {
+  let lastTick = sessionEnd.tick;
+  $effect(() => {
+    if (sessionEnd.tick === lastTick) return;
+    lastTick = sessionEnd.tick;
+    const prevId = sessionEnd.userId;
+    if (prevId) clearPersistedQueue(prevId);
+    playQueue([]);
+    closeQueueDrawer();
+  });
+});
+
 // Persistence (M7 #364): split-effect shape. Queue/index changes write
 // immediately (rare, user-driven); position changes throttle to once
 // per 5s during steady playback. See spec section "Persistence write