0.5.2: Run now for unscheduled playlists, Spotify /items migration, friendlier 403

- Run now (jobs.run_now): playlists without a daily sync time are never
  registered as scheduler jobs, so the old registered-job check 404'd. Fall
  back to running the playlist directly via pipeline_runner for any
  playlist:<name> key that isn't registered.
- Spotify removed GET /playlists/{id}/tracks in its February 2026 API changes
  in favor of /items (identical response shape). New apps are already 403'd on
  the old endpoint. Migrate both callers (app/services/spotify_client.py and
  pipeline/lib/spotify-retag.py) to /items. (The vendored sldl downloader uses
  its own bundled Spotify library and would need an upstream update when
  /tracks is fully removed.)
- Friendlier on-screen error for a Spotify 403 (check credentials + playlist
  must be public) and a README troubleshooting entry covering the 403, the
  public-playlist requirement, and the org-only extended-quota reality.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/services/spotify_client.py

@@ -57,7 +57,11 @@ def get_playlist_tracks(db: Session, playlist_url: str) -> list[dict]:
     headers = {"Authorization": f"Bearer {token}"}
 
     tracks = []
-    url = f"{API_BASE}/playlists/{playlist_id}/tracks"
+    # /items, not /tracks: Spotify removed GET /playlists/{id}/tracks in its
+    # February 2026 API changes in favor of /items (same response shape). New
+    # apps are 403'd on the old endpoint; grandfathered apps still tolerate it
+    # for now, but /items is the correct, future-proof one.
+    url = f"{API_BASE}/playlists/{playlist_id}/items"
     params = {"limit": 100, "fields": "items(track(name,artists(name),external_ids)),next"}
 
     while url: