Serve Spotify client ID from /api/config instead of baking it in at build

Was a Vite build-time env var, requiring a second copy of a non-secret
value as a separate Gitea CI secret alongside the one already in .env
for the api service. Client id isn't sensitive (public in every
Spotify authorize URL), so it doesn't need build-time baking at all —
now fetched once from a new GET /api/config on the already-running api
server, cached client-side after the first call.

Collapses config back down to the one place it already lived
(the deploy host's .env / docker-compose environment), removes the
CI build-arg and its secret entirely.

Verified end-to-end: /api/config returns the real client id, and a
live guest-login click correctly carries it through into the actual
Spotify authorize URL (decoded and checked, not just assumed from the
code).

.env.example

@@ -1,4 +1,3 @@
-# Used both at deploy time (docker-compose.yml) and by CI (as a repo secret).
 IMAGE=repo.explewd.com/explewd/fullhouse
 HOST_PORT=3080
 
@@ -7,6 +6,11 @@ HOST_PORT=3080
 # exactly (Spotify does exact string matching, trailing slash included),
 # plus a separate one for the guest PKCE flow: <your domain>/ (root,
 # no path — see client/src/lib/pkce.ts).
+#
+# This is the only place SPOTIFY_CLIENT_ID needs configuring — the
+# client fetches it from the api container's /api/config at runtime
+# (it's not sensitive data), not baked in at build time, so there's no
+# separate CI secret for it.
 SPOTIFY_CLIENT_ID=
 SPOTIFY_CLIENT_SECRET=
 SPOTIFY_HOST_REDIRECT_URI=https://fullhouse.yourdomain.com/api/spotify/callback