feat: nginx reverse proxy, Spotify import, overlay system, UI overhaul

- Add nginx as single entry point: /api/* → backend, /* → web
- NEXT_PUBLIC_API_URL="" so all API calls are relative (go through nginx)
- Add Spotify playlist import (Client Credentials OAuth, up to 500 tracks)
- Add Yandex/Spotify tabbed import UI on /playlists
- Add stream overlay system (SSE + polling fallback, 9 styles)
- Reorganize pages into (main) route group
- Add QueuePanel, VersionsPanel, Toaster components
- Add overlay settings tab in /settings

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/backend/internal/handlers/auth.go

@@ -12,6 +12,9 @@ import (
 	"gorm.io/gorm"
 )
 
+const cookieName = "pm_token"
+const cookieMaxAge = 60 * 60 * 24 * 30 // 30 days
+
 type registerReq struct {
 	Username string `json:"username" binding:"required,min=3,max=50"`
 	Email    string `json:"email" binding:"required,email"`
@@ -58,7 +61,7 @@ type loginReq struct {
 	Password string `json:"password" binding:"required"`
 }
 
-func Login(db *gorm.DB, jwtSecret string) gin.HandlerFunc {
+func Login(db *gorm.DB, jwtSecret string, cookieSecure bool) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		var req loginReq
 		if err := c.ShouldBindJSON(&req); err != nil {
@@ -83,10 +86,15 @@ func Login(db *gorm.DB, jwtSecret string) gin.HandlerFunc {
 			return
 		}
 
-		c.JSON(http.StatusOK, gin.H{
-			"token": token,
-			"user":  user,
-		})
+		c.SetCookie(cookieName, token, cookieMaxAge, "/", "", cookieSecure, true)
+		c.JSON(http.StatusOK, gin.H{"user": user})
+	}
+}
+
+func Logout(cookieSecure bool) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.SetCookie(cookieName, "", -1, "/", "", cookieSecure, true)
+		c.JSON(http.StatusOK, gin.H{"ok": true})
 	}
 }