Security: Remove email from credential logs and add live smoke test

credentials/mod.rs:
- Remove email from log messages (privacy/security best practice)
- Logs still indicate success without exposing PII

tests/qobuz_live_smoke.rs:
- Add ignored live smoke test for Qobuz API
- Requires explicit opt-in via QBZ_RUN_QOBUZ_LIVE_TESTS=1
- Uses local credentials from keyring (no hardcoded secrets)
- Basic test: login + get_favorites endpoint
- Safe for repository (no credentials exposed)

src-tauri/tests/qobuz_live_smoke.rs

@@ -0,0 +1,40 @@
+use qbz_nix_lib::{api::QobuzClient, credentials};
+
+// Live tests against Qobuz require:
+// - Explicit opt-in via env var
+// - Local credentials available via QBZ credential store (keyring or fallback file)
+//
+// These tests must never print credentials or tokens.
+
+fn live_tests_enabled() -> bool {
+    matches!(std::env::var("QBZ_RUN_QOBUZ_LIVE_TESTS").as_deref(), Ok("1"))
+}
+
+#[tokio::test]
+#[ignore]
+async fn qobuz_login_and_favorites_smoke() {
+    if !live_tests_enabled() {
+        return;
+    }
+
+    let Some(creds) = credentials::load_qobuz_credentials()
+        .expect("Failed to load credentials")
+    else {
+        return;
+    };
+
+    let client = QobuzClient::default();
+    client.init().await.expect("Failed to init client");
+
+    client
+        .login(&creds.email, &creds.password)
+        .await
+        .expect("Login failed");
+
+    // Auth + signature protected endpoint; should succeed even if empty.
+    let _ = client
+        .get_favorites("tracks", 1, 0)
+        .await
+        .expect("get_favorites failed");
+}
+