fix: replace spotdl CLI with direct curl_cffi Chrome TLS impersonation

spotdl save hangs for 60s initializing its full pipeline. Rewrite
spotify_resolve.py to use curl_cffi (already installed) which
impersonates Chrome's TLS fingerprint directly. TOTP token fetched
in Python too. RATE_LIMITED propagates without TOTP fallback.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/novasonic-server.js

@@ -365,6 +365,7 @@ async function _resolveSpotifyViaSpotdl(url) {
       if (out) {
         try {
           const data = JSON.parse(out);
+          if (data.error === 'RATE_LIMITED') return reject(new Error(`RATE_LIMITED:${data.retryAfter || 30}`));
           if (data.error) return reject(new Error(`spotdl: ${data.error}`));
           return resolve(data);
         } catch { /* not JSON, fall through */ }
@@ -376,11 +377,12 @@ async function _resolveSpotifyViaSpotdl(url) {
 }
 
 async function _resolveSpotify(type, id, originalUrl) {
-  // Primary: spotdl (TzurSoffer fork) — uses SpotAPI, no rate limits
+  // Primary: curl_cffi Chrome-impersonation + TOTP (no rate limit bucket as api keys)
   try {
     console.log('[spotify] trying spotdl resolver');
     return await _resolveSpotifyViaSpotdl(originalUrl);
   } catch (e) {
+    if (e.message.startsWith('RATE_LIMITED:')) throw e; // propagate, don't retry via TOTP
     console.log('[spotify] spotdl failed:', e.message, '— falling back to TOTP');
   }