feat: add daily Spotify sync scheduling

[rianjs]

Summary

• schedule automatic Spotify syncs every 24 hours with private persisted next-sync state and legacy fallback
• centralize durable quota/transient cooldown precedence, observation, expiration, and network-only quota clearing
• expose compositional Spotify sync status and compose the clickable Spotify/Last.fm status bar surfaces
• propagate cache-vs-network metadata through Last.fm matching and update architecture documentation

Verification

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• npm run test --prefix apps/desktop -- --run
• npm run lint --prefix apps/desktop
• npm run build --prefix apps/desktop
• node scripts/check-docs.mjs
• node scripts/check-release.mjs
• node scripts/check-tauri-acl.mjs
• npm exec --prefix apps/desktop tauri permission list
• git diff --check

Closes #60

[rianjs]

CI follow-up: the initial frontend failure was unrelated to the new permission. In a pristine checkout, and on current main run 33507025070, fails before any Rust build with . The existing already validates the checked-in command/permission manifest, and the native matrix builds Tauri on each platform, so commit 4cccf0a removes this artifact-dependent duplicate step instead of adding a Rust build to the frontend job.

[rianjs]

Correction to the previous comment: in a pristine checkout, and on current main run 33507025070, the command npx tauri permission list fails before any Rust build with the message permission file not found, please build your application once first. The existing script scripts/check-tauri-acl.mjs already validates the checked-in command and permission manifest. Commit 4cccf0a removes this artifact-dependent duplicate step; it does not add a Rust build to the frontend job.