Dynamically extracts Spotify's TOTP secret from their web-player JS bundle, computes a 6-digit HMAC-SHA1 code synced to open.spotify.com/api/server-time, and requests a token from open.spotify.com/api/token — completely bypassing the rate-limited Client Credentials token. Client Credentials kept as fallback. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>