Task 1: Create AuthService and route handleBootstrap/handleLogin through it

Introduce service.AuthService interface with Bootstrap and Login methods,
a concrete authService implementation, and a MockAuthService for testing.
Wire AuthService into api.Server and update cmd/mediaplayer/main.go to use it.

This removes direct store access from handleBootstrap and handleLogin,
fixing the DIP violation. Sentinel errors (ErrAlreadyBootstrapped,
ErrInvalidCredentials) are added to the service package so the API layer
can map them to the correct HTTP status codes without leaking DB details.

Files created:
- internal/service/auth.go

Files modified:
- internal/service/service.go
- internal/service/media.go
- internal/service/mock.go
- internal/repository/repository.go
- internal/repository/mock.go
- internal/api/server.go
- internal/api/handlers_auth.go
- internal/api/handlers_test.go
- internal/api/handlers_more_test.go
- cmd/mediaplayer/main.go

1 files changed, 2 insertions, 1 deletions

diff --git a/cmd/mediaplayer/main.go b/cmd/mediaplayer/main.go
index 812e984..68e59e1 100644
--- a/cmd/mediaplayer/main.go
+++ b/cmd/mediaplayer/main.go
@@ -84,6 +84,7 @@ func run(args []string) error {
 	adminSvc := service.NewAdminService(store, clk, hasher, fsScanner, cfg.MediaRoot)
 
 	progressSvc := service.NewProgressService(store, clk)
+	authSvc := service.NewAuthService(store, clk, hasher, sm)
 
 	// Start the background GC worker that hard-deletes soft-deleted media.
 	gcWorker := service.NewGCWorker(store, clk, cfg.MediaRoot, time.Duration(cfg.GCIntervalMinutes)*time.Minute, logger)
@@ -91,7 +92,7 @@ func run(args []string) error {
 	defer gcWorker.Stop()
 
 	staticFS := http.Dir("web")
-	server := api.NewServer(store, hasher, sm, cfg, mediaSvc, adminSvc, progressSvc, staticFS)
+	server := api.NewServer(store, hasher, sm, cfg, mediaSvc, adminSvc, progressSvc, authSvc, staticFS)
 
 	gs := api.NewGracefulServer(server, cfg)