refactor: move vendor app credentials and signing keys into config

The provider apps' own identifiers and protocol keys were scattered as
constants across six packages. They are not user secrets and stay baked in so
the tool still works out of the box, but they are now mirrored into the config
so that when a provider rotates one, a user can fix their install with a config
edit instead of waiting for a release.

Moved, each with the current value as the default in internal/config:
  qobuz     mobile_app_id, mobile_app_secret
  tidal     app_client_id, app_client_secret
  deezer    api_key, gateway_key, blowfish_secret
  yandex    sign_key, legacy_mp3_sign_salt
  beatport  app_client_id

applyVendorDefaults backfills any empty value, so configs written before these
keys existed keep working and the clients never have to nil-check them. Each
client reads through a small accessor; the package-level signing helpers
(mobileSignRequest, yandexDownloadSign, legacyDirectURL, deriveGatewayAuthToken
and friends, deriveDeezerBlowfishKey) now take the key as a parameter instead
of closing over a constant. The blowfish secret reaches internal/download
through a field on Downloader set by app.New.

The blowfish key derivation XORs 16 bytes of the secret, so a mistyped override
would have panicked; a wrong-length value is now rejected with a warning and
the built-in value is used. Tests pin the length and that the qobuz mobile
secret is valid hex, since the HKDF step requires it.

Also drops soundcloud.client_id and soundcloud.app_version: soundcloud goes
through yt-dlp, which supplies its own, so nothing read them.

config.toml.example documents each new key as "leave empty unless the vendor
rotates theirs".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/config/config.go

@@ -66,6 +66,11 @@ type QobuzConfig struct {
 	PasswordOrToken string   `toml:"password_or_token"`
 	AppID           string   `toml:"app_id"`
 	Secrets         []string `toml:"secrets"`
+
+	// Vendor app credentials for the mobile API fallback. Defaulted in code;
+	// override here when Qobuz rotates them, instead of waiting for a release.
+	MobileAppID     string `toml:"mobile_app_id"`
+	MobileAppSecret string `toml:"mobile_app_secret"`
 }
 
 type TidalConfig struct {
@@ -77,6 +82,10 @@ type TidalConfig struct {
 	AccessToken    string `toml:"access_token"`
 	RefreshToken   string `toml:"refresh_token"`
 	TokenExpiry    int64  `toml:"token_expiry"`
+
+	// Vendor OAuth app credentials. Defaulted in code; override on rotation.
+	AppClientID     string `toml:"app_client_id"`
+	AppClientSecret string `toml:"app_client_secret"`
 }
 
 type DeezerConfig struct {
@@ -86,12 +95,21 @@ type DeezerConfig struct {
 	Email                      string `toml:"email"`
 	Password                   string `toml:"password"`
 	RefreshToken               string `toml:"refresh_token"`
+
+	// Vendor protocol keys. Defaulted in code; override on rotation.
+	APIKey         string `toml:"api_key"`
+	GatewayKey     string `toml:"gateway_key"`
+	BlowfishSecret string `toml:"blowfish_secret"`
 }
 
 type YandexConfig struct {
 	Quality     int    `toml:"quality"`
 	AccessToken string `toml:"access_token"`
 	UserID      string `toml:"user_id"`
+
+	// Vendor request-signing keys. Defaulted in code; override on rotation.
+	SignKey           string `toml:"sign_key"`
+	LegacyMP3SignSalt string `toml:"legacy_mp3_sign_salt"`
 }
 
 type BeatportConfig struct {
@@ -102,12 +120,15 @@ type BeatportConfig struct {
 	AccessToken             string `toml:"access_token"`
 	RefreshToken            string `toml:"refresh_token"`
 	TokenExpiry             int64  `toml:"token_expiry"`
+
+	// Vendor OAuth app credential. Defaulted in code; override on rotation.
+	AppClientID string `toml:"app_client_id"`
 }
 
+// SoundcloudConfig has no client_id/app_version: soundcloud is handled via
+// yt-dlp, which supplies its own, so those keys were read by no code.
 type SoundcloudConfig struct {
-	Quality    int    `toml:"quality"`
-	ClientID   string `toml:"client_id"`
-	AppVersion string `toml:"app_version"`
+	Quality int `toml:"quality"`
 }
 
 type DatabaseConfig struct {
@@ -211,6 +232,60 @@ func Load(path string) (*Config, error) {
 	return &Config{Path: resolvedPath, File: data, Session: cloneConfigData(data)}, nil
 }
 
+// Vendor app credentials and protocol keys.
+//
+// These are the provider apps' own identifiers and signing keys, not user
+// secrets, and they are baked in so the tool works out of the box. They are
+// mirrored into the config so that when a provider rotates one, a user can fix
+// their install with a config edit instead of waiting for a new release.
+const (
+	DefaultQobuzMobileAppID     = "312369995"
+	DefaultQobuzMobileAppSecret = "e79f8b9be485692b0e5f9dd895826368"
+	DefaultTidalAppClientID     = "fX2JxdmntZWK0ixT"
+	DefaultTidalAppClientSecret = "1Nm5AfDAjxrgJFJbKNWLeAyKGVGmINuXPPLHVXAvxAg="
+	DefaultDeezerAPIKey         = "4VCYIJUCDLOUELGD1V8WBVYBNVDYOXEWSLLZDONGBBDFVXTZJRXPR29JRLQFO6ZE"
+	DefaultDeezerGatewayKey     = "VBK1FSUEXHTSDBJJ"
+	DefaultDeezerBlowfishSecret = "g4el58wc0zvf9na1"
+	DefaultYandexSignKey        = "kzqU4XhfCaY6B6JTHODeq5"
+	DefaultYandexLegacyMP3Salt  = "XGRlBW9FXlekgbPrRHuSiA"
+	DefaultBeatportAppClientID  = "ryZ8LuyQVPqbK2mBX2Hwt4qSMtnWuTYSqBPO92yQ"
+)
+
+// applyVendorDefaults fills in any vendor credential the user has not set, so
+// the provider clients never have to nil-check them.
+func applyVendorDefaults(data *ConfigData) {
+	if data.Qobuz.MobileAppID == "" {
+		data.Qobuz.MobileAppID = DefaultQobuzMobileAppID
+	}
+	if data.Qobuz.MobileAppSecret == "" {
+		data.Qobuz.MobileAppSecret = DefaultQobuzMobileAppSecret
+	}
+	if data.Tidal.AppClientID == "" {
+		data.Tidal.AppClientID = DefaultTidalAppClientID
+	}
+	if data.Tidal.AppClientSecret == "" {
+		data.Tidal.AppClientSecret = DefaultTidalAppClientSecret
+	}
+	if data.Deezer.APIKey == "" {
+		data.Deezer.APIKey = DefaultDeezerAPIKey
+	}
+	if data.Deezer.GatewayKey == "" {
+		data.Deezer.GatewayKey = DefaultDeezerGatewayKey
+	}
+	if data.Deezer.BlowfishSecret == "" {
+		data.Deezer.BlowfishSecret = DefaultDeezerBlowfishSecret
+	}
+	if data.Yandex.SignKey == "" {
+		data.Yandex.SignKey = DefaultYandexSignKey
+	}
+	if data.Yandex.LegacyMP3SignSalt == "" {
+		data.Yandex.LegacyMP3SignSalt = DefaultYandexLegacyMP3Salt
+	}
+	if data.Beatport.AppClientID == "" {
+		data.Beatport.AppClientID = DefaultBeatportAppClientID
+	}
+}
+
 // qualityRange is the accepted quality id range per source. Qobuz and Beatport
 // have no "lowest" tier, so their floor is 1.
 var qualityRange = map[string][2]int{
@@ -426,6 +501,7 @@ func DefaultConfigData() ConfigData {
 		},
 	}
 
+	applyVendorDefaults(&data)
 	return data
 }
 
@@ -471,6 +547,7 @@ func saveConfigData(path string, data ConfigData) error {
 }
 
 func applyRuntimeDefaults(data *ConfigData) {
+	applyVendorDefaults(data)
 	home, _ := os.UserHomeDir()
 	appDir := defaultAppDir()
 	if data.Downloads.Folder == "" {

internal/config/config_test.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"encoding/hex"
 	"errors"
 	"fmt"
 	"os"
@@ -326,3 +327,67 @@ func TestUpdateTokensPersistsAndIsConcurrencySafe(t *testing.T) {
 		t.Error("no token persisted")
 	}
 }
+
+// TestVendorDefaultsAreApplied guards the Phase-3 move of vendor credentials
+// into config: an empty value must resolve to the built-in constant, or the
+// providers silently authenticate and sign with empty keys.
+func TestVendorDefaultsAreApplied(t *testing.T) {
+	d := DefaultConfigData()
+	checks := map[string]string{
+		"qobuz.mobile_app_id":     d.Qobuz.MobileAppID,
+		"qobuz.mobile_app_secret": d.Qobuz.MobileAppSecret,
+		"tidal.app_client_id":     d.Tidal.AppClientID,
+		"tidal.app_client_secret": d.Tidal.AppClientSecret,
+		"deezer.api_key":          d.Deezer.APIKey,
+		"deezer.gateway_key":      d.Deezer.GatewayKey,
+		"deezer.blowfish_secret":  d.Deezer.BlowfishSecret,
+		"yandex.sign_key":         d.Yandex.SignKey,
+		"yandex.legacy_sign_salt": d.Yandex.LegacyMP3SignSalt,
+		"beatport.app_client_id":  d.Beatport.AppClientID,
+	}
+	for name, got := range checks {
+		if got == "" {
+			t.Errorf("%s is empty in DefaultConfigData()", name)
+		}
+	}
+
+	// An explicitly empty config must be backfilled too, since that is what a
+	// user config written before these keys existed looks like.
+	var blank ConfigData
+	applyVendorDefaults(&blank)
+	if blank.Qobuz.MobileAppSecret != DefaultQobuzMobileAppSecret {
+		t.Error("applyVendorDefaults did not backfill qobuz.mobile_app_secret")
+	}
+	if blank.Deezer.BlowfishSecret != DefaultDeezerBlowfishSecret {
+		t.Error("applyVendorDefaults did not backfill deezer.blowfish_secret")
+	}
+}
+
+func TestVendorDefaultsAreNotOverriddenWhenSet(t *testing.T) {
+	d := ConfigData{}
+	d.Tidal.AppClientID = "mine"
+	d.Deezer.BlowfishSecret = "0123456789abcdef"
+	applyVendorDefaults(&d)
+	if d.Tidal.AppClientID != "mine" {
+		t.Errorf("user value overwritten: %q", d.Tidal.AppClientID)
+	}
+	if d.Deezer.BlowfishSecret != "0123456789abcdef" {
+		t.Errorf("user value overwritten: %q", d.Deezer.BlowfishSecret)
+	}
+}
+
+// TestDeezerBlowfishSecretLength pins the length the key derivation depends
+// on: it XORs 16 bytes, so a different length would panic or silently derive a
+// wrong key.
+func TestDeezerBlowfishSecretLength(t *testing.T) {
+	if got := len(DefaultDeezerBlowfishSecret); got != 16 {
+		t.Fatalf("DefaultDeezerBlowfishSecret is %d bytes, want 16", got)
+	}
+}
+
+// TestQobuzMobileAppSecretIsHex pins the format the HKDF step requires.
+func TestQobuzMobileAppSecretIsHex(t *testing.T) {
+	if _, err := hex.DecodeString(DefaultQobuzMobileAppSecret); err != nil {
+		t.Fatalf("DefaultQobuzMobileAppSecret is not hex: %v", err)
+	}
+}