Serve Spotify client ID from /api/config instead of baking it in at build

Was a Vite build-time env var, requiring a second copy of a non-secret
value as a separate Gitea CI secret alongside the one already in .env
for the api service. Client id isn't sensitive (public in every
Spotify authorize URL), so it doesn't need build-time baking at all —
now fetched once from a new GET /api/config on the already-running api
server, cached client-side after the first call.

Collapses config back down to the one place it already lived
(the deploy host's .env / docker-compose environment), removes the
CI build-arg and its secret entirely.

Verified end-to-end: /api/config returns the real client id, and a
live guest-login click correctly carries it through into the actual
Spotify authorize URL (decoded and checked, not just assumed from the
code).

Dockerfile

@@ -6,13 +6,13 @@ COPY client/package.json client/package-lock.json* ./
 RUN npm install
 COPY client/ .
 
-# Vite bakes VITE_* vars in at build time, not runtime — has to be a
-# real build ARG, not just a container env var set later.
-ARG VITE_SPOTIFY_CLIENT_ID
-ENV VITE_SPOTIFY_CLIENT_ID=${VITE_SPOTIFY_CLIENT_ID}
 # Deliberately empty: relies on nginx same-origin-proxying /api to the
 # api service (see nginx.conf) instead of an absolute cross-origin URL
-# — the CORS bug that broke local dev earlier in this build.
+# — the CORS bug that broke local dev earlier in this build. No
+# SPOTIFY_CLIENT_ID build-arg needed — the client fetches it from
+# /api/config at runtime instead (see client/src/lib/pkce.ts); it's not
+# sensitive data, and this keeps it configured in exactly one place
+# (the server's own .env), not a second copy baked in here.
 ENV VITE_API_BASE=
 
 RUN npx tsc && npx vite build