feat(db): add SetSubsonicPassword query

Allows setting or clearing the opt-in Subsonic legacy credential.

internal/db/queries/users.sql

@@ -11,3 +11,8 @@ SELECT * FROM users WHERE api_token = $1;
 
 -- name: CountUsers :one
 SELECT count(*) FROM users;
+
+-- name: SetSubsonicPassword :exec
+-- Stores (or clears with NULL) the per-user Subsonic legacy credential used
+-- for t/s and p auth on /rest/*. Must be plaintext; see migration 0003.
+UPDATE users SET subsonic_password = $2 WHERE id = $1;