refactor: move vendor app credentials and signing keys into config

The provider apps' own identifiers and protocol keys were scattered as
constants across six packages. They are not user secrets and stay baked in so
the tool still works out of the box, but they are now mirrored into the config
so that when a provider rotates one, a user can fix their install with a config
edit instead of waiting for a release.

Moved, each with the current value as the default in internal/config:
  qobuz     mobile_app_id, mobile_app_secret
  tidal     app_client_id, app_client_secret
  deezer    api_key, gateway_key, blowfish_secret
  yandex    sign_key, legacy_mp3_sign_salt
  beatport  app_client_id

applyVendorDefaults backfills any empty value, so configs written before these
keys existed keep working and the clients never have to nil-check them. Each
client reads through a small accessor; the package-level signing helpers
(mobileSignRequest, yandexDownloadSign, legacyDirectURL, deriveGatewayAuthToken
and friends, deriveDeezerBlowfishKey) now take the key as a parameter instead
of closing over a constant. The blowfish secret reaches internal/download
through a field on Downloader set by app.New.

The blowfish key derivation XORs 16 bytes of the secret, so a mistyped override
would have panicked; a wrong-length value is now rejected with a warning and
the built-in value is used. Tests pin the length and that the qobuz mobile
secret is valid hex, since the HKDF step requires it.

Also drops soundcloud.client_id and soundcloud.app_version: soundcloud goes
through yt-dlp, which supplies its own, so nothing read them.

config.toml.example documents each new key as "leave empty unless the vendor
rotates theirs".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

config.toml.example

@@ -31,6 +31,11 @@ password_or_token = ""
 app_id = ""
 # Managed automatically by streamrip-go
 secrets = []
+# Vendor app credentials. Leave empty to use the values built into
+# streamrip-go; set them only if Qobuz rotates theirs and you need to
+# patch your install without waiting for a new release.
+mobile_app_id = ""
+mobile_app_secret = ""
 
 [tidal]
 # Quality ladder:
@@ -50,6 +55,11 @@ access_token = ""
 refresh_token = ""
 # Unix timestamp when access_token expires
 token_expiry = 0
+# Vendor app credentials. Leave empty to use the values built into
+# streamrip-go; set them only if Tidal rotates theirs and you need to
+# patch your install without waiting for a new release.
+app_client_id = ""
+app_client_secret = ""
 
 [deezer]
 # Quality ladder:
@@ -64,6 +74,13 @@ email = ""
 password = ""
 # Optional cached Deezer refresh token. Managed automatically when available.
 refresh_token = ""
+# Vendor app credentials. Leave empty to use the values built into
+# streamrip-go; set them only if Deezer rotates theirs and you need to
+# patch your install without waiting for a new release.
+api_key = ""
+gateway_key = ""
+# Must be exactly 16 characters if set.
+blowfish_secret = ""
 
 [yandex]
 # Quality ladder:
@@ -73,6 +90,11 @@ quality = 2
 access_token = ""
 # Cached current account uid. Managed automatically when available.
 user_id = ""
+# Vendor app credentials. Leave empty to use the values built into
+# streamrip-go; set them only if Yandex rotates theirs and you need to
+# patch your install without waiting for a new release.
+sign_key = ""
+legacy_mp3_sign_salt = ""
 
 [beatport]
 # Quality ladder:
@@ -90,13 +112,14 @@ access_token = ""
 refresh_token = ""
 # Unix timestamp when access_token expires
 token_expiry = 0
+# Vendor app credentials. Leave empty to use the values built into
+# streamrip-go; set them only if Beatport rotates theirs and you need to
+# patch your install without waiting for a new release.
+app_client_id = ""
 
 [soundcloud]
 # Quality is currently provider-defined (keep 0)
 quality = 0
-# Managed automatically when available
-client_id = ""
-app_version = ""
 
 [database]
 # Track IDs already downloaded are stored here and skipped next time