fix: add Spotify web-player headers to API calls, pace paginated requests

Without app-platform/spotify-app-version headers, requests look like
bot traffic and get rate-limited aggressively. Add 300ms delay between
playlist track pages to avoid burst throttling.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/novasonic-server.js

@@ -251,7 +251,18 @@ async function fetchSpotifyToken() {
 
 async function _spApi(path, token) {
   const url = path.startsWith('http') ? path : `https://api.spotify.com/v1${path}`;
-  const r = await _fetchTimeout(url, { headers: { Authorization: `Bearer ${token}` } });
+  const r = await _fetchTimeout(url, {
+    headers: {
+      'Authorization':        `Bearer ${token}`,
+      'Origin':               'https://open.spotify.com',
+      'Referer':              'https://open.spotify.com/',
+      'app-platform':         'WebPlayer',
+      'spotify-app-version':  '1.2.46.25.g7f189073',
+      'User-Agent':           'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
+      'Accept':               'application/json',
+      'Accept-Language':      'en-US,en;q=0.9',
+    },
+  });
   if (r.status === 429) {
     const retryAfter = parseInt(r.headers.get('Retry-After') || '10', 10);
     _spTokenCache  = null;
@@ -277,6 +288,7 @@ async function _spAllPlaylistTracks(id, token) {
       tracks.push(t);
     }
     path = page.next || null;
+    if (path) await new Promise(r => setTimeout(r, 300)); // pace multi-page requests
   }
   return { tracks, skippedLocal };
 }