Step 7.5a: Spotify client credentials in config/UI, write-only secrets

- Core config: cfg_mark_secret(group, key). GET /api/config returns ""
  for secret keys; a POST with "" keeps the stored value, null clears it;
  cfg_get() returns the real value. Documented in aes67-core-base.md.
- source.spotify_client_id / spotify_client_secret (secret write-only):
  each user's own Spotify developer app, needed by the maintained cspot
  fork (philippe44/cspot) since Spotify's 2025 API restrictions.
- UI: client ID field, password field for the secret ("leave empty to
  keep"), link to developer.spotify.com; enabled for spotify/auto modes.
- status.spotify_state: "no client credentials" while either is missing.
- Verified: secret never appears in GET; UI-style re-save keeps it;
  survives reboot; null clears it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

main/player.c

@@ -95,7 +95,11 @@ static void player_status(cJSON *st)
                         s_src == SRC_SPOTIFY ? "not implemented" : s_playing ? "playing" : "buffering";
     cJSON_AddStringToObject(st, "active_source", SRC_NAME[s_src]);
     cJSON_AddStringToObject(st, "source_state", state);
-    cJSON_AddStringToObject(st, "spotify_state", "not implemented");
+    cJSON *src = cfg_get("source");
+    bool creds = cJSON_GetObjectItemCaseSensitive(src, "spotify_client_id")->valuestring[0] &&
+                 cJSON_GetObjectItemCaseSensitive(src, "spotify_client_secret")->valuestring[0];
+    cJSON_Delete(src);
+    cJSON_AddStringToObject(st, "spotify_state", creds ? "not implemented" : "no client credentials");
     cJSON_AddNumberToObject(st, "buffer_ms", (double)(audio_ring_level() * 1000 / RATE));
 }