Player: runtime source override and play-a-URL on /api/player

The player now owns the effective mode (config or override) and passes it
down: spotify_apply(enable) and hls_set_url(url) instead of both reading
source.mode from the config. /api/player/source forces spotify|hls|off
(config returns to the saved mode), /api/player/url plays an m3u8 now;
neither is saved. GET reports it in `forced`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

components/spotify/include/spotify.h

@@ -25,13 +25,14 @@ typedef void (*spotify_event_cb_t)(spotify_event_t ev, int value);
 // played out so far. Used to tell Spotify when a new track actually becomes audible.
 typedef uint32_t (*spotify_pos_cb_t)(void);
 
-// Registers the zeroconf endpoints (/spotify_info), starts the session task and applies the config.
+// Registers the zeroconf endpoints (/spotify_info) and starts the session task (disabled until
+// spotify_apply(true)).
 esp_err_t spotify_init(spotify_pcm_cb_t pcm, spotify_event_cb_t event, spotify_pos_cb_t written,
                        spotify_pos_cb_t played);
-// Re-read the "source" config: enabled (advertised, sessions accepted) when mode is spotify/auto and
-// the client credentials are set; otherwise not advertised and a running session is ended.
-// A new device name ends the session and re-advertises.
-void spotify_apply(void);
+// Enable (advertised, sessions accepted) when the player's mode needs Spotify and the client
+// credentials are set; otherwise not advertised and a running session is ended. Re-reads name and
+// credentials from the "source" config: a new device name ends the session and re-advertises.
+void spotify_apply(bool enable);
 typedef enum {
     SPOTIFY_CMD_PLAY, SPOTIFY_CMD_PAUSE, SPOTIFY_CMD_NEXT, SPOTIFY_CMD_PREV,
     SPOTIFY_CMD_SEEK,       // arg: position in ms