feat(for-you): re-introduce /users/{id}/feed/for-you with lean 3-source pipeline (#817)

## Summary

Brings back `GET /v1/users/{id}/feed/for-you` (removed in #807) with a
leaner pipeline that drops the source that was causing the prod
timeouts.

The killer in the original was the `similar_artists` CTE — a 1-hop
saves-graph self-join that produced a 301M-row merge for power users.
Dropped entirely. The lean pipeline keeps the other three sources:

| Source | What it pulls | Cap |
|---|---|---|
| `in_network` | Tracks uploaded in the last 14 days by users I follow |
200 |
| `trending` | Top week-trending from `track_trending_scores` | 100 |
| `underground` | Week-trending tracks whose owner has < 1500 follower &
following count | 50 |

Same ranking formula as before:

```
recency_score    = exp(-ln(2) * age_hours / 48)
engagement_score = ln(1 + 3*saves + 2*reposts + 1*plays) / 12
social_boost     = 1.0 + least(affinity/4, 1.0)
source_weight    = {in_network: 1.20, trending: 1.00, underground: 0.95}
final_score = (0.55*recency + 0.45*engagement) * social_boost * source_weight
```

Same Go-side diversity pass (per-artist `ROW_NUMBER()` cap + 5-position
lookahead to break consecutive-same-artist runs).

## Perf guardrails

Retained from #805 / #806:
- `follow_set` capped at 500 most-recently-followed.
- `my_artist_affinity` sub-selects capped (200 saves / 200 reposts / 500
plays, all by recency).

Additional:
- `my_artist_affinity` inner `JOIN tracks` is now further restricted to
tracks created in the last 90 days — old uploads can't pull the CTE
wide.
- New partial index `idx_track_trending_scores_for_you` on
`track_trending_scores (score DESC, track_id)` covering the `TRACKS /
pnagD / week / null-genre` slice. Without it, EXPLAIN showed a fixed
~12s scan of `track_trending_scores` for every request, regardless of
caller.

## Files

| File | What |
|---|---|
|
[`api/v1_users_feed_for_you.go`](https://github.com/AudiusProject/api/blob/claude/eager-wilson-e22923/api/v1_users_feed_for_you.go)
| Handler + the 3-source candidate-pool SQL (no similar_artists) |
|
[`api/v1_users_feed_for_you_test.go`](https://github.com/AudiusProject/api/blob/claude/eager-wilson-e22923/api/v1_users_feed_for_you_test.go)
| Basic tests: valid user_id required, empty feed for new user,
pagination |
|
[`api/server.go`](https://github.com/AudiusProject/api/blob/claude/eager-wilson-e22923/api/server.go)
| Route re-registration |
|
[`api/auth_middleware.go`](https://github.com/AudiusProject/api/blob/claude/eager-wilson-e22923/api/auth_middleware.go)
| Re-add the `/feed/for-you` exemption (query `user_id` is advisory;
path `:userId` controls personalization) |
|
[`api/swagger/swagger-v1.yaml`](https://github.com/AudiusProject/api/blob/claude/eager-wilson-e22923/api/swagger/swagger-v1.yaml)
| Re-add the endpoint spec |
|
[`ddl/migrations/0198_track_trending_scores_for_you_idx.sql`](https://github.com/AudiusProject/api/blob/claude/eager-wilson-e22923/ddl/migrations/0198_track_trending_scores_for_you_idx.sql)
| The missing partial index |

## Test plan

- [x] `go build ./api/...` clean
- [x] `go vet ./api/...` clean
- [x] `go test -c ./api/...` compiles
- [ ] After deploy: hit
`/v1/users/{id}/feed/for-you?user_id={id}&limit=5` for a power-user
account that previously timed out — should now return 200 in < 2s.
- [ ] Eyeball the mix of in-network vs trending vs underground on a real
account.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dylanjeffers

api/auth_middleware.go

@@ -347,8 +347,16 @@ func (app *ApiServer) authMiddleware(c *fiber.Ctx) error {
 		return fiber.NewError(fiber.StatusUnauthorized, "Invalid or expired access token")
 	}
 
-	// Not authorized to act on behalf of myId
-	if myId != 0 && !pkceAuthed && !app.isAuthorizedRequest(c.Context(), myId, wallet) {
+	// Not authorized to act on behalf of myId.
+	//
+	// Exception: /users/:userId/feed/for-you accepts user_id as a viewer hint
+	// used only for response decoration (has_current_user_reposted etc.); the
+	// path :userId — not user_id — controls what gets personalized. Treat the
+	// query user_id as advisory rather than authoritative on this route so
+	// the endpoint can be called like the other public read endpoints.
+	allowUnauthenticatedViewerId := strings.HasSuffix(c.Path(), "/feed/for-you")
+
+	if myId != 0 && !pkceAuthed && !allowUnauthenticatedViewerId && !app.isAuthorizedRequest(c.Context(), myId, wallet) {
 		return fiber.NewError(
 			fiber.StatusForbidden,
 			fmt.Sprintf(

api/server.go

@@ -454,6 +454,7 @@ func NewApiServer(config config.Config) *ApiServer {
 		g.Get("/users/:userId/contests", app.v1UserContests)
 		g.Get("/users/:userId/playlists", app.v1UserPlaylists)
 		g.Get("/users/:userId/feed", app.v1UsersFeed)
+		g.Get("/users/:userId/feed/for-you", app.v1FeedForYou)
 		g.Get("/users/:userId/connected_wallets", app.v1UsersConnectedWallets)
 		g.Get("/users/:userId/transactions/audio", app.v1UsersTransactionsAudio)
 		g.Get("/users/:userId/transactions/audio/count", app.v1UsersTransactionsAudioCount)

api/swagger/swagger-v1.yaml

@@ -9475,6 +9475,75 @@ paths:
         "500":
           description: Server error
           content: {}
+  /users/{id}/feed/for-you:
+    get:
+      tags:
+        - users
+      summary: Get For You feed for user
+      description:
+        Returns a personalized For You feed for the user identified in the
+        path. Twitter-style multi-source pipeline — candidate retrieval
+        (in-network, trending, underground) → linear ranking (recency
+        decay × engagement × social affinity, weighted by source) →
+        diversity (per-artist cap + consecutive-same-artist lookahead).
+      operationId: Get User For You Feed
+      security:
+        - {}
+        - OAuth2:
+            - read
+      parameters:
+        - name: id
+          in: path
+          description: A User ID
+          required: true
+          schema:
+            type: string
+        - name: limit
+          in: query
+          description: The number of items to fetch
+          schema:
+            type: integer
+            default: 25
+            minimum: 1
+            maximum: 100
+        - name: offset
+          in: query
+          description:
+            The number of items to skip. Useful for pagination (page number
+            * limit)
+          schema:
+            type: integer
+            default: 0
+            minimum: 0
+            maximum: 200
+        - name: max_per_artist
+          in: query
+          description:
+            Maximum number of tracks per artist on a single page. Used by the
+            diversity pass to cap consecutive same-artist results.
+          schema:
+            type: integer
+            default: 3
+            minimum: 1
+            maximum: 10
+        - name: user_id
+          in: query
+          description: The user ID of the user making the request
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/tracks"
+        "400":
+          description: Bad request
+          content: {}
+        "500":
+          description: Server error
+          content: {}
   /users/{id}/library/albums:
     get:
       tags: