Add playlist_service and credential_service

playlist_service: CRUD for the playlists table, playlists.json export,
regen.sh invocation, and a one-time seed_legacy() importing the 17-entry
legacy array. Creating/updating a playlist automatically re-renders confs
and re-patches credentials into any newly-generated .conf file.

credential_service: encrypted credential storage (via security/crypto.py)
and per-scope rendering to the exact files the pipeline scripts read --
every <playlist>.conf (spotify/soulseek), navidrome/admin.env,
bandcamp/config.env+cookies.txt, azuracast/api_key, qobuz/{token,app_id,region},
telegram/notify.env. set_credentials() batches multi-field saves so a render
never sees a half-populated scope.

Also fixes a real bug found via integration testing: regen.sh's embedded
python3 -c snippet used backslash-escaped quotes inside a single-quoted
bash string, which is invalid Python syntax (backslash passed through
literally) -- switched to double-quoted bash wrapper + single-quoted Python
strings.

Verified end-to-end: seeded 17 playlists, regenerated all 17 .conf files,
saved spotify/soulseek/navidrome credentials and confirmed correct
patching into rendered files (including bash-sourcing admin.env with
special characters in the password), and confirmed delete/create both
correctly add/remove .conf files with credentials pre-patched on create.

pipeline/configs/regen.sh

@@ -33,13 +33,13 @@ fi
 mkdir -p "$CONFIG_OUT_DIR"
 
 # One "name<TAB>spotify_url" line per playlist, active or not (see header).
-python3 -c '
+python3 -c "
 import json, sys
 with open(sys.argv[1]) as f:
     playlists = json.load(f)
 for p in playlists:
-    print(f"{p[\"name\"]}\t{p[\"spotify_url\"]}")
-' "$PLAYLISTS_JSON" | while IFS=$'\t' read -r name url; do
+    print(p['name'] + '\t' + p['spotify_url'])
+" "$PLAYLISTS_JSON" | while IFS=$'\t' read -r name url; do
   [[ -z "$name" ]] && continue
   sed -e "s|PLAYLIST_NAME|${name}|g" \
       -e "s|SPOTIFY_URL|${url}|g" \