R7: consolidate duplicated Spotify-token and NDJSON-parse logic

- The client-credentials token fetch was copy-pasted across spotify-retag.py,
  spotify-genre.py, and fix-track-metadata.py (and the app's spotify_client).
  Add pipeline/lib/_spotify_auth.get_token (cached per id/secret); the three
  scripts now source their own credentials but delegate the request to it. The
  scripts run with pipeline/lib on sys.path, so the plain `from _spotify_auth
  import get_token` resolves.
- The identical _parse_json_lines helper in dedup_review_service and
  genre_review_service is now a single app/services/_ndjson.parse_json_lines.

Verified: unit test of the token helper (cache + request), the NDJSON parser
(tests/test_ndjson.py), full suite green (40), and a live spotify-genre dry-run
that fetched a token and queried Spotify through the shared helper.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pipeline/lib/spotify-genre.py

@@ -25,8 +25,10 @@ Usage:
   spotify-genre.py --apply --force          # overwrite existing GENRE tags
   spotify-genre.py --apply --query '...'    # subset by beets query
 """
-import sys, os, re, json, argparse, base64, urllib.parse, urllib.request, subprocess
+import sys, os, re, json, argparse, urllib.parse, urllib.request, subprocess
 from pathlib import Path
+
+from _spotify_auth import get_token
 from mutagen import File as MFile
 from mutagen.id3 import ID3, ID3NoHeaderError, TCON
 from mutagen.flac import FLAC
@@ -73,19 +75,8 @@ def load_whitelist():
     return out
 
 
-_token = None
 def _spotify_token():
-    global _token
-    if _token: return _token
-    creds = base64.b64encode(f"{SPOTIFY_CID}:{SPOTIFY_CSEC}".encode()).decode()
-    req = urllib.request.Request(
-        "https://accounts.spotify.com/api/token",
-        data=urllib.parse.urlencode({"grant_type":"client_credentials"}).encode(),
-        headers={"Authorization":f"Basic {creds}",
-                 "Content-Type":"application/x-www-form-urlencoded"})
-    with urllib.request.urlopen(req, timeout=15) as r:
-        _token = json.loads(r.read())["access_token"]
-    return _token
+    return get_token(SPOTIFY_CID, SPOTIFY_CSEC)
 
 
 # Cache: artist_name → list[str] of Spotify genres (or None if not found)