Listen without a pl8list account

"start listening" on the sign-in page makes a guest: a user with a negative
id and a session of its own, so the feed, likes, follows and radio work as
for anyone. Signing in with pl8list later moves the guest's plays, likes and
follows to the account. Signing out as a guest deletes it; guests whose
session ran out are purged hourly. New guests are capped at 10 per IP and
hour, and that limiter forgets IPs hourly. The privacy policy covers guests.

web/src/api.ts

@@ -61,6 +61,8 @@ export interface Stats {
 export interface User {
   handle: string;
   name: string | null;
+  /// Listening without a pl8list account.
+  guest?: boolean;
 }
 
 export interface Pl8Status {