Add music bot for self-hosted Stoat with web control panel

Plays audio into Stoat voice channels over LiveKit and exposes the same
player through both chat commands and a browser panel, so the two never
drift apart: everything routes through a single MusicManager.

- core: per-server GuildPlayer (queue, loop, shuffle, seek, volume,
  idle auto-leave) driving revoice.js/@livekit/rtc-node and ffmpeg
- sources: yt-dlp for YouTube/SoundCloud, direct media URLs and internet
  radio, optional local library with path-traversal guards
- bot: 18 chat commands with aliases, plus !panel one-time login links
- api: Fastify REST + WebSocket, sessions authenticated against the
  instance's own /auth/session/login (TOTP supported), permissions
  re-checked against Stoat membership and roles on every request
- web: React panel with search, queue editing, seek and volume
- deploy: Dockerfile, compose.override.yml and Caddyfile snippets for
  dropping the service into an existing /opt/stoat stack

Verified with npm run typecheck, both builds, and scripts/smoke-api.mjs
(9 API checks). Voice playback itself needs a live instance to test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/Caddyfile.snippet

@@ -0,0 +1,15 @@
+# Добавьте отдельным блоком в /opt/stoat/Caddyfile, рядом с {$HOSTNAME} { ... }.
+#
+# У вас Caddy слушает только 80 (127.0.0.1:8880 → 80), а TLS терминирует
+# внешний прокси на хосте, поэтому используем схему http:// —
+# так Caddy не будет пытаться сам выпускать сертификат.
+http://music.example.com {
+	reverse_proxy http://mbot:3005
+}
+
+# Если внешнего прокси нет и Caddy сам держит 80/443 — просто:
+# music.example.com {
+# 	reverse_proxy http://mbot:3005
+# }
+#
+# WebSocket (/ws) проксируется автоматически, отдельных директив не нужно.