Add public shareable taste profiles

Users can generate a share link for their taste profile via the
"Share My Taste" button. The link opens a public page showing
listening personality, genre breakdown, audio features, and top
artists with a CTA to register. Token-based URL prevents enumeration.

backend/app/api/endpoints/profile.py

@@ -1,7 +1,10 @@
-from fastapi import APIRouter, Depends
+import hashlib
+
+from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.core.config import settings
 from app.core.database import get_db
 from app.core.security import get_current_user
 from app.models.user import User
@@ -198,3 +201,164 @@ async def get_taste_profile(
         "track_count": len(all_tracks),
         "playlist_count": len(playlists),
     }
+
+
+async def _build_taste_profile(user_id: int, db: AsyncSession) -> dict:
+    """Build a taste profile dict for the given user_id (shared logic)."""
+    result = await db.execute(
+        select(Playlist).where(Playlist.user_id == user_id)
+    )
+    playlists = list(result.scalars().all())
+
+    all_tracks = []
+    for p in playlists:
+        result = await db.execute(select(Track).where(Track.playlist_id == p.id))
+        all_tracks.extend(result.scalars().all())
+
+    if not all_tracks:
+        return {
+            "genre_breakdown": [],
+            "audio_features": {
+                "energy": 0,
+                "danceability": 0,
+                "valence": 0,
+                "acousticness": 0,
+                "avg_tempo": 0,
+            },
+            "personality": {
+                "label": "New Listener",
+                "description": "Import some playlists to discover your listening personality!",
+                "icon": "music",
+            },
+            "top_artists": [],
+            "track_count": 0,
+            "playlist_count": len(playlists),
+        }
+
+    # Genre breakdown
+    genres_count: dict[str, int] = {}
+    for t in all_tracks:
+        if t.genres:
+            for g in t.genres:
+                genres_count[g] = genres_count.get(g, 0) + 1
+
+    total_genre_mentions = sum(genres_count.values()) or 1
+    top_genres = sorted(genres_count.items(), key=lambda x: x[1], reverse=True)[:10]
+    genre_breakdown = [
+        {"name": g, "percentage": round((c / total_genre_mentions) * 100, 1)}
+        for g, c in top_genres
+    ]
+
+    # Audio features averages + variance
+    energies = []
+    danceabilities = []
+    valences = []
+    acousticnesses = []
+    tempos = []
+
+    for t in all_tracks:
+        if t.energy is not None:
+            energies.append(t.energy)
+        if t.danceability is not None:
+            danceabilities.append(t.danceability)
+        if t.valence is not None:
+            valences.append(t.valence)
+        if t.acousticness is not None:
+            acousticnesses.append(t.acousticness)
+        if t.tempo is not None:
+            tempos.append(t.tempo)
+
+    def avg(lst: list[float]) -> float:
+        return round(sum(lst) / len(lst), 3) if lst else 0
+
+    def variance(lst: list[float]) -> float:
+        if len(lst) < 2:
+            return 0
+        m = sum(lst) / len(lst)
+        return sum((x - m) ** 2 for x in lst) / len(lst)
+
+    avg_energy = avg(energies)
+    avg_danceability = avg(danceabilities)
+    avg_valence = avg(valences)
+    avg_acousticness = avg(acousticnesses)
+    avg_tempo = round(avg(tempos), 0)
+
+    # Personality
+    personality = _determine_personality(
+        genre_count=len(genres_count),
+        avg_energy=avg_energy,
+        avg_valence=avg_valence,
+        avg_acousticness=avg_acousticness,
+        energy_variance=variance(energies),
+        valence_variance=variance(valences),
+    )
+
+    # Top artists
+    artist_count: dict[str, int] = {}
+    for t in all_tracks:
+        artist_count[t.artist] = artist_count.get(t.artist, 0) + 1
+    top_artists_sorted = sorted(artist_count.items(), key=lambda x: x[1], reverse=True)[:8]
+
+    artist_genres: dict[str, str] = {}
+    for t in all_tracks:
+        if t.artist in dict(top_artists_sorted) and t.genres and t.artist not in artist_genres:
+            artist_genres[t.artist] = t.genres[0]
+
+    top_artists = [
+        {
+            "name": name,
+            "track_count": count,
+            "genre": artist_genres.get(name, ""),
+        }
+        for name, count in top_artists_sorted
+    ]
+
+    return {
+        "genre_breakdown": genre_breakdown,
+        "audio_features": {
+            "energy": round(avg_energy * 100),
+            "danceability": round(avg_danceability * 100),
+            "valence": round(avg_valence * 100),
+            "acousticness": round(avg_acousticness * 100),
+            "avg_tempo": avg_tempo,
+        },
+        "personality": personality,
+        "top_artists": top_artists,
+        "track_count": len(all_tracks),
+        "playlist_count": len(playlists),
+    }
+
+
+def _generate_profile_token(user_id: int) -> str:
+    """Generate a deterministic share token for a user's profile."""
+    return hashlib.sha256(
+        f"profile:{user_id}:{settings.SECRET_KEY}".encode()
+    ).hexdigest()[:16]
+
+
+@router.get("/share-link")
+async def get_profile_share_link(user: User = Depends(get_current_user)):
+    """Generate a share link for the user's taste profile."""
+    token = _generate_profile_token(user.id)
+    return {"share_url": f"{settings.FRONTEND_URL}/taste/{user.id}/{token}"}
+
+
+@router.get("/public/{user_id}/{token}")
+async def get_public_profile(
+    user_id: int,
+    token: str,
+    db: AsyncSession = Depends(get_db),
+):
+    """Public taste profile — no auth required."""
+    expected = _generate_profile_token(user_id)
+    if token != expected:
+        raise HTTPException(status_code=404, detail="Invalid profile link")
+
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if not user:
+        raise HTTPException(status_code=404, detail="Profile not found")
+
+    profile = await _build_taste_profile(user_id, db)
+    profile["name"] = user.name.split()[0]  # First name only for privacy
+    return profile