security(spotify): migrate desktop OAuth to Authorization Code + PKCE

[postigodev]

Summary

Sendo currently treats the Spotify desktop client as a confidential OAuth client and asks users to provide a client secret.

Desktop applications cannot reliably keep a client secret confidential because the application binary and local configuration are controlled by the end user. Spotify supports Authorization Code with PKCE specifically for public clients such as desktop applications, and the current rspotify dependency already exposes a PKCE client type.

Expected outcome

Move Sendo's Spotify authentication flow to Authorization Code + PKCE so users only need the public client ID and redirect URI.

Acceptance criteria

• remove the Spotify client secret requirement from the desktop setup flow
• use the PKCE OAuth flow supported by rspotify
• preserve the local loopback callback flow and manual callback fallback where practical
• migrate or gracefully handle existing configs that contain spotify_client_secret
• update health/status/configuration checks to reflect the new required fields
• update UI and documentation so users are no longer instructed to paste a client secret into Sendo
• retain token caching/refresh behavior
• add focused coverage around Spotify configuration validation after the migration

Constraints

• do not weaken OAuth state validation
• avoid introducing a custom OAuth implementation when the dependency already supports PKCE
• keep existing users from being stranded by stale config fields

Likely files

• crates/core/src/spotify/mod.rs
• crates/core/src/config/mod.rs
• apps/tauri/src/pages/spotify.ts
• apps/tauri/src/types.ts
• README/install docs