Add Spotify direct API integration for lyrics, ISRC matching, and playlist ordering

Features:
- SpotifyApiClient: Direct Spotify API client using sp_dc session cookie
- SpotifyLyricsService: Fetch synced lyrics from Spotify's color-lyrics API
- SpotifyPlaylistFetcher: Get playlists with correct track ordering and ISRC codes
- SpotifyTrackMatchingService: ISRC-based exact track matching for external providers

Improvements:
- Lyrics endpoint now prioritizes: 1) Jellyfin embedded, 2) Spotify synced, 3) LRCLIB
- Fixed playback progress reporting - removed incorrect body wrapping for Jellyfin API
- Added SpotifyApiSettings configuration model

Security:
- Session cookie and client ID properly masked in startup logs
- All credentials read from environment variables only

.env.example

@@ -149,3 +149,40 @@ SPOTIFY_IMPORT_PLAYLIST_LOCAL_TRACKS_POSITIONS=
 # Format: [["PlaylistName","JellyfinPlaylistId","first|last"],...]
 # Note: This format may not work in .env files due to Docker Compose limitations
 # SPOTIFY_IMPORT_PLAYLISTS=[["Discover Weekly","4383a46d8bcac3be2ef9385053ea18df","first"],["Release Radar","ba50e26c867ec9d57ab2f7bf24cfd6b0","last"]]
+
+# ===== SPOTIFY DIRECT API (RECOMMENDED - ENABLES TRACK ORDERING & LYRICS) =====
+# This is the preferred method for Spotify playlist integration.
+# Provides: Correct track ordering, ISRC-based exact matching, synchronized lyrics
+# Does NOT require the Jellyfin Spotify Import plugin (can work standalone)
+
+# Enable direct Spotify API access (default: false)
+SPOTIFY_API_ENABLED=false
+
+# Spotify Client ID from https://developer.spotify.com/dashboard
+# Create an app in the Spotify Developer Dashboard to get this
+SPOTIFY_API_CLIENT_ID=
+
+# Spotify Client Secret (optional - only needed for certain OAuth flows)
+SPOTIFY_API_CLIENT_SECRET=
+
+# Spotify session cookie (sp_dc) - REQUIRED for editorial playlists
+# Editorial playlists (Release Radar, Discover Weekly, etc.) require authentication
+# via session cookie because they're not accessible through the official API.
+#
+# To get your sp_dc cookie:
+# 1. Open https://open.spotify.com in your browser and log in
+# 2. Open DevTools (F12) → Application → Cookies → https://open.spotify.com
+# 3. Find the cookie named "sp_dc" and copy its value
+# 4. Note: This cookie expires periodically (typically every few months)
+SPOTIFY_API_SESSION_COOKIE=
+
+# Cache duration for playlist data in minutes (default: 60)
+# Release Radar updates weekly, Discover Weekly updates Mondays
+SPOTIFY_API_CACHE_DURATION_MINUTES=60
+
+# Rate limit delay between API requests in milliseconds (default: 100)
+SPOTIFY_API_RATE_LIMIT_DELAY_MS=100
+
+# Prefer ISRC matching over fuzzy title/artist matching (default: true)
+# ISRC provides exact track identification across different streaming services
+SPOTIFY_API_PREFER_ISRC_MATCHING=true