R7: consolidate duplicated Spotify-token and NDJSON-parse logic

- The client-credentials token fetch was copy-pasted across spotify-retag.py,
  spotify-genre.py, and fix-track-metadata.py (and the app's spotify_client).
  Add pipeline/lib/_spotify_auth.get_token (cached per id/secret); the three
  scripts now source their own credentials but delegate the request to it. The
  scripts run with pipeline/lib on sys.path, so the plain `from _spotify_auth
  import get_token` resolves.
- The identical _parse_json_lines helper in dedup_review_service and
  genre_review_service is now a single app/services/_ndjson.parse_json_lines.

Verified: unit test of the token helper (cache + request), the NDJSON parser
(tests/test_ndjson.py), full suite green (40), and a live spotify-genre dry-run
that fetched a token and queried Spotify through the shared helper.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/services/dedup_review_service.py

@@ -7,6 +7,7 @@ from sqlalchemy import or_, select
 from app.db import SessionLocal
 from app.models import DedupCandidate, DedupRun
 from app.services import pipeline_runner
+from app.services._ndjson import parse_json_lines
 from app.settings import settings
 
 _SCRIPT = "dedup-library.sh"
@@ -57,19 +58,6 @@ def _is_pair_already_pending(db, keep_path: str, delete_path: str) -> bool:
     return db.execute(query).first() is not None
 
 
-def _parse_json_lines(output: str) -> list[dict]:
-    candidates = []
-    for line in output.splitlines():
-        line = line.strip()
-        if not line.startswith("{"):
-            continue
-        try:
-            candidates.append(json.loads(line))
-        except json.JSONDecodeError:
-            continue
-    return candidates
-
-
 async def _run_scan(job_key: str, script_name: str, triggered_by: str) -> DedupRun | None:
     """Returns None (persisting nothing) if the job never actually ran --
     e.g. skipped_lock because something else was using the pipeline lock
@@ -84,7 +72,7 @@ async def _run_scan(job_key: str, script_name: str, triggered_by: str) -> DedupR
     if job_run.status != "success":
         return None
 
-    candidates = _parse_json_lines(output)
+    candidates = parse_json_lines(output)
 
     db = SessionLocal()
     try: