feat(auth): RequireUser middleware (cookie or bearer)

Resolves /api/* callers from session cookie first, Authorization
bearer second. Touches last_seen on success for future active-
sessions UI. Adds GetUserByID query used by the middleware.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/db/queries/users.sql

@@ -16,3 +16,6 @@ SELECT count(*) FROM users;
 -- Stores (or clears with NULL) the per-user Subsonic legacy credential used
 -- for t/s and p auth on /rest/*. Must be plaintext; see migration 0003.
 UPDATE users SET subsonic_password = $2 WHERE id = $1;
+
+-- name: GetUserByID :one
+SELECT * FROM users WHERE id = $1;