Step 7.5a: Spotify client credentials in config/UI, write-only secrets

- Core config: cfg_mark_secret(group, key). GET /api/config returns ""
  for secret keys; a POST with "" keeps the stored value, null clears it;
  cfg_get() returns the real value. Documented in aes67-core-base.md.
- source.spotify_client_id / spotify_client_secret (secret write-only):
  each user's own Spotify developer app, needed by the maintained cspot
  fork (philippe44/cspot) since Spotify's 2025 API restrictions.
- UI: client ID field, password field for the secret ("leave empty to
  keep"), link to developer.spotify.com; enabled for spotify/auto modes.
- status.spotify_state: "no client credentials" while either is missing.
- Verified: secret never appears in GET; UI-style re-save keeps it;
  survives reboot; null clears it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/index.html

@@ -71,6 +71,11 @@ e.g. curl -X POST http://p4-aes67.local/api/player/next
 <label><span>Spotify device name</span><input name="source.spotify_name"></label>
 <label><span>Spotify bitrate</span><select name="source.spotify_bitrate">
   <option>96</option><option>160</option><option>320</option></select></label>
+<label><span>Spotify client ID</span><input name="source.spotify_client_id" autocomplete="off"></label>
+<label><span>Spotify client secret</span><input name="source.spotify_client_secret" type="password"
+  autocomplete="new-password" placeholder="stored; leave empty to keep"></label>
+<small>Your own app from <a href="https://developer.spotify.com/dashboard" target="_blank">developer.spotify.com</a>
+  (Premium account). The secret is never shown again once saved.</small>
 <label><span>Stream URL</span><input name="source.hls_url" type="url" placeholder="https://…/playlist.m3u8"></label>
 <label><span>Autoplay stream on boot</span><input name="source.autoplay" type="checkbox"></label>
 <label><span>Output gain (dB)</span><input name="source.gain_db" type="number" min="-60" max="12" step="0.5"></label>
@@ -208,7 +213,7 @@ const PROJECT = {
   title: 'P4 AES67 Streamer',
   def: {
     source:{mode:'spotify',spotify_name:'P4 AES67',spotify_bitrate:'320',hls_url:'',autoplay:false,gain_db:0,
-            failover_delay_s:5,failover_on_pause:false},
+            failover_delay_s:5,failover_on_pause:false,spotify_client_id:'',spotify_client_secret:''},
     aes67:{name:'P4 AES67'},
     net:{hostname:'p4-aes67'}
   },
@@ -216,6 +221,7 @@ const PROJECT = {
     const m = f['source.mode'].value;
     const sp = m === 'spotify' || m === 'auto', hl = m === 'hls' || m === 'auto';
     f['source.spotify_name'].disabled = f['source.spotify_bitrate'].disabled = !sp;
+    f['source.spotify_client_id'].disabled = f['source.spotify_client_secret'].disabled = !sp;
     f['source.hls_url'].disabled = !hl;
     f['source.autoplay'].disabled = m !== 'hls';
     f['source.failover_delay_s'].disabled = f['source.failover_on_pause'].disabled = m !== 'auto';