fix(spotify): validate redirect URL before auth

[xuyua9]

Summary

• validate Spotify redirect URLs as explicit HTTP loopback IPs with ports before status and auth paths
• distinguish invalid redirect configuration from missing credentials
• add regression coverage for IPv4/IPv6 loopback and invalid callback URLs

The existing core path treated any non-empty redirect URL as configured, while local callback setup validated much later. This keeps the existing OAuth and playback behavior unchanged and makes the failure actionable earlier.

Relates to #10.

Validation

• cargo fmt --all -- --check
• cargo test -p desk_remote_core spotify:: --lib
• cargo test -p desk_remote_core --lib
• git diff --check

[vercel]

@xuyua9 is attempting to deploy a commit to the postigodev's projects Team on Vercel.

A member of the Team first needs to authorize it.