feat(api): add POST /api/events handler

Discriminated-union JSON over three event types: play_started,
play_ended, play_skipped. Auth via existing RequireUser. play_started
returns play_event_id + session_id; the other two return { ok: true }.
Validates ownership: play_ended/play_skipped on another user's row
returns 403. Mount signature now takes EventsConfig and constructs
the playevents.Writer; server.New propagates it through.

internal/api/library_test.go

@@ -7,6 +7,8 @@ import (
 	"testing"
 
 	"github.com/go-chi/chi/v5"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/config"
 )
 
 // newLibraryRouter builds a test-only chi router with the library handlers
@@ -433,7 +435,11 @@ func TestHandleListArtists_EmptyDB(t *testing.T) {
 func TestRoutesRegisteredInMount(t *testing.T) {
 	h, _ := testHandlers(t)
 	r := chi.NewRouter()
-	Mount(r, h.pool, h.logger)
+	Mount(r, h.pool, h.logger, config.EventsConfig{
+		SessionTimeoutMinutes:   30,
+		SkipMaxCompletionRatio:  0.5,
+		SkipMaxDurationPlayedMs: 30000,
+	})
 
 	paths := []string{
 		"/api/artists",