feat: switch Spotify auth to official Client Credentials Flow

Replaces the broken open.spotify.com/get_access_token scrape with
accounts.spotify.com/api/token (Basic auth, client_credentials grant).
Adds SPOTIFY_CLIENT_ID/SECRET to config, docker-compose, and .env.example.
Health endpoint now reports spotify.configured; frontend disables the
importer and shows a setup guide when credentials are missing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/lib/config.js

@@ -9,6 +9,9 @@ const CONFIG = {
   downloadBackend: (process.env.DOWNLOAD_BACKEND || 'auto').toLowerCase(),
   // squid.wtf quality: 'mp3' | 'flac' | 'hi-res'
   squidQuality:    (process.env.SQUID_QUALITY   || 'mp3').toLowerCase(),
+  // Spotify Developer credentials (Client Credentials Flow — free, no Premium needed)
+  spotifyClientId:     process.env.SPOTIFY_CLIENT_ID     || '',
+  spotifyClientSecret: process.env.SPOTIFY_CLIENT_SECRET || '',
 };
 
 module.exports = CONFIG;