R7: consolidate duplicated Spotify-token and NDJSON-parse logic

- The client-credentials token fetch was copy-pasted across spotify-retag.py,
  spotify-genre.py, and fix-track-metadata.py (and the app's spotify_client).
  Add pipeline/lib/_spotify_auth.get_token (cached per id/secret); the three
  scripts now source their own credentials but delegate the request to it. The
  scripts run with pipeline/lib on sys.path, so the plain `from _spotify_auth
  import get_token` resolves.
- The identical _parse_json_lines helper in dedup_review_service and
  genre_review_service is now a single app/services/_ndjson.parse_json_lines.

Verified: unit test of the token helper (cache + request), the NDJSON parser
(tests/test_ndjson.py), full suite green (40), and a live spotify-genre dry-run
that fetched a token and queried Spotify through the shared helper.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/services/genre_review_service.py

@@ -1,26 +1,12 @@
-import json
-
 from app.db import SessionLocal
 from app.models import GenreCandidate, GenreRun
 from app.services import genre_fix, pipeline_runner
+from app.services._ndjson import parse_json_lines
 from app.settings import settings
 
 _SCRIPT = "spotify-genre.py"
 
 
-def _parse_json_lines(output: str) -> list[dict]:
-    candidates = []
-    for line in output.splitlines():
-        line = line.strip()
-        if not line.startswith("{"):
-            continue
-        try:
-            candidates.append(json.loads(line))
-        except json.JSONDecodeError:
-            continue
-    return candidates
-
-
 async def run(apply: bool, force: bool = False, triggered_by: str = "schedule") -> GenreRun | None:
     """Run spotify-genre.py --json (dry-run or --apply), persisting the
     diff into a fresh genre_runs/genre_candidates pair either way.
@@ -50,7 +36,7 @@ async def run(apply: bool, force: bool = False, triggered_by: str = "schedule")
     if job_run.status != "success":
         return None
 
-    candidates = _parse_json_lines(output)
+    candidates = parse_json_lines(output)
 
     db = SessionLocal()
     try: