Serves playlists, their dumps and their covers. :playlistId is a playlist's id; its page reads it by its path, through GET /api/users/:key/playlists/:slug.

• GET /api/playlists?category=&sort=&page=&limit= — public. Answers a page of every public playlist, in the order sort names (PLAYLIST_SORTS, the last to take a dump first by default), or only those in the playlist category at category, which 404s when there is none.
• POST /api/playlists — signed in. Creates a playlist, filed under the playlist categories it names.
• GET /api/playlists/:playlistId — optional sign-in. Answers a playlist with the dumps the caller may see in it. A private one 404s but for its owner.
• PUT /api/playlists/:playlistId — signed in, as its owner or with playlist:moderate. Updates its title, slug, description, visibility and categories. A new slug keeps the old one as an alias, 3 times a day at most but for those with playlist:moderate.
• DELETE /api/playlists/:playlistId — signed in, as its owner or with playlist:moderate. Deletes it.
• POST /api/playlists/:playlistId/dumps/:dumpId — signed in, as its owner or with playlist:moderate. Adds a dump at the top.
• DELETE /api/playlists/:playlistId/dumps/:dumpId — signed in, as its owner or with playlist:moderate. Removes a dump.
• PUT /api/playlists/:playlistId/cover — signed in, as its owner or with playlist:moderate. Replaces its cover (multipart file, at most 5 MB).
• GET /api/playlists/:playlistId/cover?w=&token= — public, but a private playlist's cover needs its owner's media token. Serves its cover, scaled down to w (shared/image.ts) when it names one, or 404s without one.
• PUT /api/playlists/:playlistId/order — signed in, as its owner or with playlist:moderate. Reorders the dumps the caller can see in it.

Which of the caller's playlists hold a dump is GET /api/me/playlists's.