feat: add multi-user support for favorites management and room clock synchronization

- Implemented a new API endpoint for retrieving and managing user favorites in /api/users.
- Added functionality for admins to edit the shared "main" user's favorites.
- Created a one-shot DB smoke test script for verifying multi-user kiosk migrations.
- Introduced a RoomClock class for synchronizing server time across clients using WebSocket.

web/shared/api.js

@@ -1,9 +1,10 @@
-async function http(method, path, body) {
+async function http(method, path, body, opts = {}) {
     const res = await fetch(path, {
         method,
         credentials: 'same-origin',
         headers: body ? { 'Content-Type': 'application/json' } : {},
-        body: body ? JSON.stringify(body) : undefined
+        body: body ? JSON.stringify(body) : undefined,
+        signal: opts.signal
     });
     if (res.status === 204) return null;
     const ct = res.headers.get('content-type') || '';
@@ -12,10 +13,16 @@ async function http(method, path, body) {
     return data;
 }
 
+// Returns true for AbortError thrown by `fetch(... { signal })` so callers can
+// silently ignore cancelled requests instead of surfacing them as errors.
+export function isAbort(err) {
+    return err && (err.name === 'AbortError' || err.code === 20);
+}
+
 export const api = {
-    get: (p) => http('GET', p),
-    post: (p, b) => http('POST', p, b),
-    put: (p, b) => http('PUT', p, b),
-    patch: (p, b) => http('PATCH', p, b),
-    del: (p) => http('DELETE', p)
+    get: (p, opts) => http('GET', p, null, opts),
+    post: (p, b, opts) => http('POST', p, b, opts),
+    put: (p, b, opts) => http('PUT', p, b, opts),
+    patch: (p, b, opts) => http('PATCH', p, b, opts),
+    del: (p, opts) => http('DELETE', p, null, opts)
 };