feat: add multi-user support for favorites management and room clock synchronization

- Implemented a new API endpoint for retrieving and managing user favorites in /api/users.
- Added functionality for admins to edit the shared "main" user's favorites.
- Created a one-shot DB smoke test script for verifying multi-user kiosk migrations.
- Introduced a RoomClock class for synchronizing server time across clients using WebSocket.

server/db/index.js

@@ -71,5 +71,25 @@ function runMigrations(db) {
     if (!playCols.has('total_play_ms')) {
         db.exec('ALTER TABLE station_plays ADD COLUMN total_play_ms INTEGER NOT NULL DEFAULT 0');
     }
+
+    // Multi-user kiosk: per-user metadata + designation of "main" identity.
+    const userCols = new Set(db.prepare("PRAGMA table_info(users)").all().map((c) => c.name));
+    if (!userCols.has('is_main')) {
+        db.exec('ALTER TABLE users ADD COLUMN is_main INTEGER NOT NULL DEFAULT 0');
+    }
+    if (!userCols.has('avatar_color')) {
+        db.exec('ALTER TABLE users ADD COLUMN avatar_color TEXT');
+    }
+    if (!userCols.has('avatar_emoji')) {
+        db.exec('ALTER TABLE users ADD COLUMN avatar_emoji TEXT');
+    }
+    db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_users_only_one_main ON users(is_main) WHERE is_main = 1');
+
+    // Cross-client stream sync: when a room enters 'play', record the wall-clock
+    // moment so every client can target the same playhead.
+    const stateCols = new Set(db.prepare("PRAGMA table_info(room_state)").all().map((c) => c.name));
+    if (!stateCols.has('started_at')) {
+        db.exec('ALTER TABLE room_state ADD COLUMN started_at INTEGER');
+    }
 }