Serve Spotify client ID from /api/config instead of baking it in at build

Was a Vite build-time env var, requiring a second copy of a non-secret
value as a separate Gitea CI secret alongside the one already in .env
for the api service. Client id isn't sensitive (public in every
Spotify authorize URL), so it doesn't need build-time baking at all —
now fetched once from a new GET /api/config on the already-running api
server, cached client-side after the first call.

Collapses config back down to the one place it already lived
(the deploy host's .env / docker-compose environment), removes the
CI build-arg and its secret entirely.

Verified end-to-end: /api/config returns the real client id, and a
live guest-login click correctly carries it through into the actual
Spotify authorize URL (decoded and checked, not just assumed from the
code).

server/index.js

@@ -12,6 +12,15 @@ app.use(express.json());
 
 app.get('/api/health', (req, res) => res.json({ ok: true }));
 
+// Spotify's client id is not sensitive (it's public in every authorize
+// URL, visible in any browser network tab) — served here instead of
+// baked into the client at build time so the whole app has exactly one
+// place to configure it (this server's own .env), not a second copy as
+// a separate CI build-arg/secret.
+app.get('/api/config', (req, res) => {
+  res.json({ clientId: process.env.SPOTIFY_CLIENT_ID });
+});
+
 app.use('/api/spotify', hostAuth);
 app.use('/api/host', hostPlaylists);
 app.use('/api/public-playlist', publicPlaylist);