Port all API routes to Hono with zod validation

Port every route domain onto the Hono app: albums, artists, auth, bookmarks, stats, settings, spotify, tracks, genres, and the dev-only test reset.

• Validation moves from safeParse calls inside controllers to @hono/zod-validator on the route definitions, handlers read typed input via c.req.valid()
• Keep /scores registered before /:albumID (route order still matters)
• Controller/service split stays as is, this is a transport swap, not a service rewrite
• The Express app keeps running until the whole surface is ported, then the cutover ticket swaps it out