fix: Dedupe track collaborators in API responses

[raymondjacobson]

Summary

• Filter embedded track collaborators through an order-preserving de-dupe before resolving API response users.
• Exclude the track owner from both accepted and pending collaborator arrays as a response-boundary guard.
• Add unit coverage for the de-dupe helper and extend the collaborator response test for owner-as-collaborator rows.

Notes

The track_collaborators table already has a (track_id, collaborator_user_id) primary key, and the current go-openaudio ETL path already excludes owners and de-dupes collaborator metadata before writing. This API guard is intentionally defensive so malformed rows or future query changes cannot leak duplicate/owner collaborator entries to clients.

Testing

• go test ./api/dbv1
• go test ./api -run TestTrackCollaboratorsEmbeddedOnTrack
• go test ./api/dbv1 ./api -run 'TestUniqueCollaboratorIDs|TestTrackCollaboratorsEmbeddedOnTrack'\n- git diff --check\n