feat(tui): add Spotify settings tab to picker

[vxcozy]

Summary

• Adds a fourth Settings tab to the picker modal so single-pane users can see their Spotify auth state, Connect device name, and resolved daemon.toml path without dropping out of the TUI.
• New Verb::ReadConfig → Event::ConfigSnapshot round-trip: the daemon owns the truth about config + credential-file state; the client only renders.
• 1/2/3/4 jump to a tab directly (outside the Search input where they are printable); Tab now cycles Radio → Search → Library → Settings → Radio.

Why

Before this PR, users who ran clitunes as a single pane had no way to see whether Spotify was authenticated, what their Connect device was named, or where the daemon was reading config from. The Library tab listed Spotify data but offered no auth hook, so a logged-out user browsing Saved Tracks got a silent empty list with no guidance. Settings is discoverability-first: we name the problem (auth state) and name the fix (clitunes auth in another terminal).

Read-only in this slice by design. A write path (edit device name, toggle Connect, trigger auth from the TUI) opens a multi-process race and a TUI-vs-editor focus question that are not worth solving inside a papercut PR.

Auth-surface audit (Phase 1 findings)

• clitunes auth already exists as a first-class subcommand that drives load_or_authenticate with full headless / SSH-port-forward handling.
• The daemon never runs interactive auth; it only reads the credential cache produced by clitunes auth. Auth state is therefore inspectable purely from disk.
• There was no IPC verb for config reads before this PR. Verb::ReadConfig is the minimal addition needed to surface state; the payload is deliberately narrow (only fields the Settings tab actually renders).

What the Settings tab shows

• Spotify auth status: Logged in / Logged out / Needs re-auth (missing scopes) / Error:
• Connect device name + whether the receiver is enabled
• Resolved daemon.toml path (from the same resolver the daemon boots with)
• Spotify credential cache path (so users know which file clitunes auth writes to)
• A one-line instruction that tells the user exactly which command to run, tailored to the current auth state

Test plan

• cargo fmt --check clean
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo test --workspace --all-features — 480 engine tests + all downstream crates green, including new paint / state / verb / event roundtrip tests
• Manual smoke: open picker, press 4, confirm auth state + device name render; run clitunes auth in another terminal, press Enter to refresh, confirm status flips to "Logged in"

Closes clitunes-dn9 / CLI-90

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.