Add music bot for self-hosted Stoat with web control panel

Plays audio into Stoat voice channels over LiveKit and exposes the same
player through both chat commands and a browser panel, so the two never
drift apart: everything routes through a single MusicManager.

- core: per-server GuildPlayer (queue, loop, shuffle, seek, volume,
  idle auto-leave) driving revoice.js/@livekit/rtc-node and ffmpeg
- sources: yt-dlp for YouTube/SoundCloud, direct media URLs and internet
  radio, optional local library with path-traversal guards
- bot: 18 chat commands with aliases, plus !panel one-time login links
- api: Fastify REST + WebSocket, sessions authenticated against the
  instance's own /auth/session/login (TOTP supported), permissions
  re-checked against Stoat membership and roles on every request
- web: React panel with search, queue editing, seek and volume
- deploy: Dockerfile, compose.override.yml and Caddyfile snippets for
  dropping the service into an existing /opt/stoat stack

Verified with npm run typecheck, both builds, and scripts/smoke-api.mjs
(9 API checks). Voice playback itself needs a live instance to test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/index.ts

@@ -0,0 +1,43 @@
+import { startApiServer } from "./api/server.js";
+import { startBot } from "./bot/index.js";
+import { config } from "./config.js";
+import { MusicManager } from "./core/manager.js";
+import { logger } from "./logger.js";
+import { checkYtDlp } from "./sources/index.js";
+
+async function main(): Promise<void> {
+  const ytdlpVersion = await checkYtDlp();
+  if (ytdlpVersion) {
+    logger.info({ version: ytdlpVersion }, "yt-dlp detected");
+  } else {
+    logger.warn(
+      { path: config.YTDLP_PATH },
+      "yt-dlp not found — YouTube/SoundCloud playback will fail; only direct links and local files will work",
+    );
+  }
+
+  const manager = new MusicManager();
+  const bot = await startBot(manager);
+  const app = await startApiServer({ manager, context: bot.context });
+
+  const shutdown = async (signal: string): Promise<void> => {
+    logger.info({ signal }, "shutting down");
+    try {
+      await app.close();
+      await bot.stop();
+    } catch (err) {
+      logger.error({ err }, "shutdown failed");
+    } finally {
+      process.exit(0);
+    }
+  };
+
+  process.on("SIGINT", () => void shutdown("SIGINT"));
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
+  process.on("unhandledRejection", (err) => logger.error({ err }, "unhandled rejection"));
+}
+
+main().catch((err) => {
+  logger.fatal({ err }, "failed to start");
+  process.exit(1);
+});