Remove API key injection from GitHub workflows

All API credentials are now managed server-side through the Cloudflare
Workers proxy. Build workflows no longer need to inject secrets into
the binary.

Removed:
- SPOTIFY_API_CLIENT_ID/SECRET from release-linux.yml
- TIDAL_API_CLIENT_ID/SECRET from release-linux.yml
- DISCOGS_API_CLIENT_KEY/SECRET from release-linux.yml
- LAST_FM_API_KEY/SHARED_SECRET from release-linux.yml
- Complete 'Inject API secrets' step from release-flatpak.yml

This completes the API keys refactor for Flathub compliance.

.github/workflows/release-flatpak.yml

@@ -85,49 +85,6 @@ jobs:
             org.freedesktop.Sdk.Extension.node20//25.08 \
             org.freedesktop.Sdk.Extension.rust-stable//25.08
 
-      - name: Inject API secrets into Flatpak manifest
-        env:
-          SPOTIFY_API_CLIENT_ID: ${{ secrets.SPOTIFY_API_CLIENT_ID }}
-          SPOTIFY_API_CLIENT_SECRET: ${{ secrets.SPOTIFY_API_CLIENT_SECRET }}
-          TIDAL_API_CLIENT_ID: ${{ secrets.TIDAL_API_CLIENT_ID }}
-          TIDAL_API_CLIENT_SECRET: ${{ secrets.TIDAL_API_CLIENT_SECRET }}
-          DISCOGS_API_CLIENT_KEY: ${{ secrets.DISCOGS_API_CLIENT_KEY }}
-          DISCOGS_API_CLIENT_SECRET: ${{ secrets.DISCOGS_API_CLIENT_SECRET }}
-          LAST_FM_API_KEY: ${{ secrets.LAST_FM_API_KEY }}
-          LAST_FM_API_SHARED_SECRET: ${{ secrets.LAST_FM_API_SHARED_SECRET }}
-        run: |
-          # Inject env vars into the qbz module's build-options.env in the manifest
-          python3 << 'PY'
-          import yaml
-          import os
-
-          with open('packaging/flatpak/com.blitzkriegfc.qbz.yml', 'r') as f:
-              manifest = yaml.safe_load(f)
-
-          # Find the qbz module and add env vars
-          for module in manifest.get('modules', []):
-              if module.get('name') == 'qbz':
-                  if 'build-options' not in module:
-                      module['build-options'] = {}
-                  if 'env' not in module['build-options']:
-                      module['build-options']['env'] = {}
-
-                  env_vars = [
-                      'SPOTIFY_API_CLIENT_ID', 'SPOTIFY_API_CLIENT_SECRET',
-                      'TIDAL_API_CLIENT_ID', 'TIDAL_API_CLIENT_SECRET',
-                      'DISCOGS_API_CLIENT_KEY', 'DISCOGS_API_CLIENT_SECRET',
-                      'LAST_FM_API_KEY', 'LAST_FM_API_SHARED_SECRET'
-                  ]
-                  for var in env_vars:
-                      val = os.environ.get(var, '')
-                      if val:
-                          module['build-options']['env'][var] = val
-                  break
-
-          with open('packaging/flatpak/com.blitzkriegfc.qbz.yml', 'w') as f:
-              yaml.dump(manifest, f, default_flow_style=False, sort_keys=False)
-          PY
-
       - name: Build Flatpak
         run: |
           mkdir -p flatpak-build flatpak-repo dist

.github/workflows/release-linux.yml

@@ -92,15 +92,6 @@ jobs:
         run: npm ci
 
       - name: Build DEB/RPM/AppImage
-        env:
-          SPOTIFY_API_CLIENT_ID: ${{ secrets.SPOTIFY_API_CLIENT_ID }}
-          SPOTIFY_API_CLIENT_SECRET: ${{ secrets.SPOTIFY_API_CLIENT_SECRET }}
-          TIDAL_API_CLIENT_ID: ${{ secrets.TIDAL_API_CLIENT_ID }}
-          TIDAL_API_CLIENT_SECRET: ${{ secrets.TIDAL_API_CLIENT_SECRET }}
-          DISCOGS_API_CLIENT_KEY: ${{ secrets.DISCOGS_API_CLIENT_KEY }}
-          DISCOGS_API_CLIENT_SECRET: ${{ secrets.DISCOGS_API_CLIENT_SECRET }}
-          LAST_FM_API_KEY: ${{ secrets.LAST_FM_API_KEY }}
-          LAST_FM_API_SHARED_SECRET: ${{ secrets.LAST_FM_API_SHARED_SECRET }}
         run: npm run tauri build -- --bundles deb,rpm,appimage
 
       - name: Collect artifacts