Document all four redirect URIs, not just the two local dev ones

Spent a real debugging session chasing a "not matching configuration"
error assuming it was host mode, when it was actually guest PKCE mode
hitting a redirect URI (production, root path) that was simply never
registered — the README only documented the two local dev URIs, not
that host mode and guest mode each need their own entry per
environment (four total), and gave no way to tell which flow's
request was actually failing.

Added the full four-URI table and a note to check the browser's actual
address bar at the point of failure — the error message is identical
regardless of which flow's redirect_uri didn't match.

README.md

@@ -63,14 +63,26 @@ cd server && npm install && npm run dev   # :3010
 cd client && npm install && npm run dev   # :3080 in prod, :5190 locally
 ```
 
-Register two redirect URIs in the Spotify dashboard (exact string match,
+Register **four** redirect URIs in the Spotify dashboard — one pair per
-trailing slash matters):
+environment, host mode and guest mode each need their own. Exact string
+match, trailing slash included: guest mode is `${window.location.origin}/`
+(`client/src/lib/pkce.ts`) — that trailing slash is not optional, ever,
+in any environment.
 
-- `http://127.0.0.1:3010/api/spotify/callback` — host mode
+| Environment | Host mode (`/api/spotify/callback`) | Guest PKCE mode (root, no path) |
-- `http://127.0.0.1:5190/` — guest PKCE mode (root, no path)
+|---|---|---|
+| Local dev | `http://127.0.0.1:3010/api/spotify/callback` | `http://127.0.0.1:5190/` |
+| Production | `https://<your-domain>/api/spotify/callback` | `https://<your-domain>/` |
 
-(`127.0.0.1`, not `localhost` — Spotify's HTTPS-required-for-redirect
+(`127.0.0.1`, not `localhost`, for local dev — Spotify's
-policy only exempts the literal loopback IP.)
+HTTPS-required-for-redirect policy only exempts the literal loopback IP.)
+
+All four need to actually exist in the dashboard's list — host mode and
+guest mode failing to match are indistinguishable from the outside
+("redirect_uri: Not matching configuration" either way), so if this
+error shows up, check the browser's actual address bar at the point of
+failure to see which flow's redirect_uri is actually being sent before
+assuming which one is missing.
 
 ## Deploying