feat: add multi-user support for favorites management and room clock synchronization

- Implemented a new API endpoint for retrieving and managing user favorites in /api/users.
- Added functionality for admins to edit the shared "main" user's favorites.
- Created a one-shot DB smoke test script for verifying multi-user kiosk migrations.
- Introduced a RoomClock class for synchronizing server time across clients using WebSocket.

server/start.js

@@ -12,7 +12,7 @@ import { fileURLToPath } from 'node:url';
 import { existsSync } from 'node:fs';
 
 import { initDb } from './db/index.js';
-import { authMiddleware, ensureBootstrapAdmin } from './auth.js';
+import { authMiddleware, ensureBootstrapAdmin, ensureMainUser } from './auth.js';
 import { applySeedIfEmpty } from './sources/seed.js';
 import { scheduleHealthCheck } from './streams/checker.js';
 import { attachWs } from './ws.js';
@@ -24,6 +24,7 @@ import { router as meRoutes } from './routes/me.js';
 import { router as adminRoutes } from './routes/admin.js';
 import { router as v1Routes } from './routes/v1.js';
 import { router as roomRoutes } from './routes/rooms.js';
+import { router as userRoutes } from './routes/users.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -37,6 +38,7 @@ export async function startServer(opts = {}) {
         username: process.env.ADMIN_BOOTSTRAP_USER,
         password: process.env.ADMIN_BOOTSTRAP_PASSWORD
     });
+    ensureMainUser(process.env.MAIN_USER || 'morphix');
     const seedResult = applySeedIfEmpty();
     console.log('[seed]', seedResult);
     ensureImageDirs();
@@ -48,6 +50,7 @@ export async function startServer(opts = {}) {
     app.use('/api/auth', authRoutes);
     app.use('/api/stations', stationRoutes);
     app.use('/api/me', meRoutes);
+    app.use('/api/users', userRoutes);
     app.use('/api/admin', adminRoutes);
     app.use('/api/rooms', roomRoutes);
     app.use('/api/v1', v1Routes);