R7: consolidate duplicated Spotify-token and NDJSON-parse logic

- The client-credentials token fetch was copy-pasted across spotify-retag.py,
  spotify-genre.py, and fix-track-metadata.py (and the app's spotify_client).
  Add pipeline/lib/_spotify_auth.get_token (cached per id/secret); the three
  scripts now source their own credentials but delegate the request to it. The
  scripts run with pipeline/lib on sys.path, so the plain `from _spotify_auth
  import get_token` resolves.
- The identical _parse_json_lines helper in dedup_review_service and
  genre_review_service is now a single app/services/_ndjson.parse_json_lines.

Verified: unit test of the token helper (cache + request), the NDJSON parser
(tests/test_ndjson.py), full suite green (40), and a live spotify-genre dry-run
that fetched a token and queried Spotify through the shared helper.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/services/_ndjson.py

@@ -0,0 +1,17 @@
+import json
+
+
+def parse_json_lines(output: str) -> list[dict]:
+    """Parse NDJSON mixed with human-readable log lines: each line that starts
+    with '{' is treated as a JSON object, everything else is ignored. Used to
+    pull the structured candidate lines out of a pipeline script's stdout."""
+    out = []
+    for line in output.splitlines():
+        line = line.strip()
+        if not line.startswith("{"):
+            continue
+        try:
+            out.append(json.loads(line))
+        except json.JSONDecodeError:
+            continue
+    return out

app/services/dedup_review_service.py

@@ -7,6 +7,7 @@ from sqlalchemy import or_, select
 from app.db import SessionLocal
 from app.models import DedupCandidate, DedupRun
 from app.services import pipeline_runner
+from app.services._ndjson import parse_json_lines
 from app.settings import settings
 
 _SCRIPT = "dedup-library.sh"
@@ -57,19 +58,6 @@ def _is_pair_already_pending(db, keep_path: str, delete_path: str) -> bool:
     return db.execute(query).first() is not None
 
 
-def _parse_json_lines(output: str) -> list[dict]:
-    candidates = []
-    for line in output.splitlines():
-        line = line.strip()
-        if not line.startswith("{"):
-            continue
-        try:
-            candidates.append(json.loads(line))
-        except json.JSONDecodeError:
-            continue
-    return candidates
-
-
 async def _run_scan(job_key: str, script_name: str, triggered_by: str) -> DedupRun | None:
     """Returns None (persisting nothing) if the job never actually ran --
     e.g. skipped_lock because something else was using the pipeline lock
@@ -84,7 +72,7 @@ async def _run_scan(job_key: str, script_name: str, triggered_by: str) -> DedupR
     if job_run.status != "success":
         return None
 
-    candidates = _parse_json_lines(output)
+    candidates = parse_json_lines(output)
 
     db = SessionLocal()
     try:

app/services/genre_review_service.py

@@ -1,26 +1,12 @@
-import json
-
 from app.db import SessionLocal
 from app.models import GenreCandidate, GenreRun
 from app.services import genre_fix, pipeline_runner
+from app.services._ndjson import parse_json_lines
 from app.settings import settings
 
 _SCRIPT = "spotify-genre.py"
 
 
-def _parse_json_lines(output: str) -> list[dict]:
-    candidates = []
-    for line in output.splitlines():
-        line = line.strip()
-        if not line.startswith("{"):
-            continue
-        try:
-            candidates.append(json.loads(line))
-        except json.JSONDecodeError:
-            continue
-    return candidates
-
-
 async def run(apply: bool, force: bool = False, triggered_by: str = "schedule") -> GenreRun | None:
     """Run spotify-genre.py --json (dry-run or --apply), persisting the
     diff into a fresh genre_runs/genre_candidates pair either way.
@@ -50,7 +36,7 @@ async def run(apply: bool, force: bool = False, triggered_by: str = "schedule")
     if job_run.status != "success":
         return None
 
-    candidates = _parse_json_lines(output)
+    candidates = parse_json_lines(output)
 
     db = SessionLocal()
     try: