0.5.2: Run now for unscheduled playlists, Spotify /items migration, friendlier 403

- Run now (jobs.run_now): playlists without a daily sync time are never
  registered as scheduler jobs, so the old registered-job check 404'd. Fall
  back to running the playlist directly via pipeline_runner for any
  playlist:<name> key that isn't registered.
- Spotify removed GET /playlists/{id}/tracks in its February 2026 API changes
  in favor of /items (identical response shape). New apps are already 403'd on
  the old endpoint. Migrate both callers (app/services/spotify_client.py and
  pipeline/lib/spotify-retag.py) to /items. (The vendored sldl downloader uses
  its own bundled Spotify library and would need an upstream update when
  /tracks is fully removed.)
- Friendlier on-screen error for a Spotify 403 (check credentials + playlist
  must be public) and a README troubleshooting entry covering the 403, the
  public-playlist requirement, and the org-only extended-quota reality.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/routers/jobs.py

@@ -6,7 +6,7 @@ from sqlalchemy import select
 from app.db import get_db
 from app.models import JobRun, ScheduledJob
 from app.security.deps import require_auth
-from app.services import scheduler_service
+from app.services import pipeline_runner, playlist_service, scheduler_service
 
 router = APIRouter(prefix="/settings/jobs", tags=["jobs"])
 templates = Jinja2Templates(directory="app/templates")
@@ -67,7 +67,9 @@ async def runs_table_partial(request: Request, user: dict = Depends(require_auth
 
 
 @router.post("/{job_key:path}/run")
-async def run_now(job_key: str, background: BackgroundTasks, user: dict = Depends(require_auth)):
+async def run_now(
+    job_key: str, background: BackgroundTasks, user: dict = Depends(require_auth), db=Depends(get_db)
+):
     scheduler = scheduler_service.get_scheduler()
     if scheduler is None:
         raise HTTPException(503, "scheduler not running")
@@ -75,10 +77,23 @@ async def run_now(job_key: str, background: BackgroundTasks, user: dict = Depend
     # background and redirect immediately. A playlist sync can take the better
     # part of an hour; awaiting it here would hang the browser/reverse proxy.
     # Progress shows up in the runs table below, which polls every few seconds.
-    if scheduler.get_job(job_key) is None:
-        raise HTTPException(404, f"no such registered job: {job_key}")
-    background.add_task(scheduler_service.trigger_now, scheduler, job_key)
-    return RedirectResponse(url="/settings/jobs?started=1", status_code=303)
+    if scheduler.get_job(job_key) is not None:
+        background.add_task(scheduler_service.trigger_now, scheduler, job_key)
+        return RedirectResponse(url="/settings/jobs?started=1", status_code=303)
+
+    # Playlists with no cron_expr (or paused) are never registered with the
+    # scheduler by sync_playlist_jobs -- that's "unscheduled/manual-only" by
+    # design, not missing. Run it directly through pipeline_runner instead of
+    # requiring a scheduler job to exist, so "Run now" works for those too.
+    if job_key.startswith("playlist:"):
+        playlist = playlist_service.get_by_name(db, job_key.removeprefix("playlist:"))
+        if playlist is not None:
+            background.add_task(
+                pipeline_runner.run_playlist, playlist.name, playlist.no_m3u, "manual"
+            )
+            return RedirectResponse(url="/settings/jobs?started=1", status_code=303)
+
+    raise HTTPException(404, f"no such registered job: {job_key}")
 
 
 @router.post("/{job_key:path}/toggle")

app/routers/playlists.py

@@ -1,3 +1,4 @@
+import httpx
 from fastapi import APIRouter, Depends, Form, HTTPException, Request
 from fastapi.responses import RedirectResponse
 from fastapi.templating import Jinja2Templates
@@ -10,6 +11,19 @@ router = APIRouter(prefix="/playlists", tags=["playlists"])
 templates = Jinja2Templates(directory="app/templates")
 
 
+def _friendly_status_error(exc: Exception) -> str:
+    """Turn a raw Spotify API error into something a non-technical user can act
+    on. 403 here almost always means the Spotify app can't read the playlist:
+    either the credentials are wrong or the playlist isn't public."""
+    if isinstance(exc, httpx.HTTPStatusError) and exc.response.status_code == 403:
+        return (
+            "Spotify denied access (403). Check your Spotify credentials under "
+            "Settings then Credentials, and make sure the playlist is set to public "
+            "on Spotify -- alembic can't read private playlists."
+        )
+    return str(exc)
+
+
 @router.get("")
 async def playlists_index(request: Request, user: dict = Depends(require_auth), db=Depends(get_db)):
     playlists = playlist_service.list_all(db)
@@ -54,7 +68,7 @@ async def playlist_detail(
     try:
         status = status_service.playlist_status(db, playlist.name, playlist.spotify_url)
     except Exception as exc:
-        error = str(exc)
+        error = _friendly_status_error(exc)
 
     return templates.TemplateResponse(
         request,