feat: PKCE auth flow + custom Client ID

[0Chencc]

Summary

• PKCE Migration: Replace Authorization Code Flow with PKCE, removing client_secret requirement entirely. Default client_id hardcoded in AppConfig, setup guide screen removed for zero-config onboarding.
• Custom Client ID: Users can override the default Client ID via Settings > Advanced Options or directly on the Login screen (accessible even when rate-limited). All auth/token/playback code unified through effectiveSpotifyClientIdProvider.
• TokenRefreshService rebuild: Lazy singleton is automatically rebuilt when client_id changes, tracked via _lastTokenRefreshClientId.

Changes

• AppConfig: added default spotifyClientId
• OAuthService: PKCE flow with code_verifier / code_challenge
• AuthRepositoryImpl / TokenRefreshService: accept clientId parameter instead of reading AppConfig directly
• CredentialsLocalDataSource: added getCustomSpotifyClientId() / saveCustomSpotifyClientId() / clearCustomSpotifyClientId()
• CredentialsProvider: added customSpotifyClientId state + effectiveSpotifyClientIdProvider
• FocusSessionProvider / PlaybackProvider: replaced AppConfig.spotifyClientId with effectiveSpotifyClientIdProvider
• LoginScreen: added Advanced Options section for pre-login Client ID configuration
• ApiCredentialsSection: added collapsible Advanced Options with save/clear + re-auth prompt
• L10n: 8 new keys across zh/en/ja
• Removed setup_guide_screen.dart, updated READMEs, added iOS screenshot

Test plan

• Default flow: fresh install → login with built-in Client ID → playback works
• Custom Client ID (Settings): set custom ID → prompted to re-login → authorize with new ID → playback works
• Custom Client ID (Login screen): set custom ID before login → login → works
• Clear custom ID → reverts to default → re-login required
• Token refresh uses correct Client ID after switch
• macOS + iOS: SharedPreferences persistence works for custom Client ID