feat(qobuz): track lyrics endpoint with live-verified wire DTOs

Add /track/lyricsUrl (signed RPC, method name "tracklyricsUrl") plus
the CDN document fetch through the offline choke point. Wire shapes
were validated against live captures (2026-06-10) and diverge from the
inferred yaml: numeric track_id in the step-1 envelope, CDN document
wrapped in {translation_langs, publishers, writers, original}, "wsync"
word-synced discriminator instead of "lsync" (per-word timestamps),
plain lines as objects, and miss = HTTP 404 error body mapped to a
typed Ok(None) instead of an error. Unit tests deserialize fixture
excerpts of the captures; examples/lyrics_probe.rs is the read-only
live probe used for the capture.

Also expose qbz_credentials::load_oauth_token_from_file so a stale
keyring entry cannot shadow the authoritative encrypted token file.

cc

crates/qbz-qobuz/tests/fixtures/lyrics-doc-plain.json

@@ -0,0 +1,39 @@
+{
+    "album_id": "5052205066164",
+    "track_id": 29006863,
+    "translation_langs": [],
+    "publishers": [
+        {
+            "copyright": "Reservoir Media Management, Inc.",
+            "zones": [
+                "WW",
+                "FR"
+            ]
+        },
+        {
+            "copyright": "Reservoir Media Management, Inc., Sony/ATV Music Publishing LLC",
+            "zones": [
+                "FR"
+            ]
+        }
+    ],
+    "writers": "DEVIN GARRETT TOWNSEND",
+    "original": {
+        "type": "plain",
+        "lang": "en",
+        "lines": [
+            {
+                "line": "Night follows me when you're gone"
+            },
+            {
+                "line": "And now how am I to carry on?"
+            },
+            {
+                "line": "But into the night into the darkness"
+            },
+            {
+                "line": "I must be strong, carry on"
+            }
+        ]
+    }
+}