refactor: delete dead code, dedupe helpers, add tests for untested packages

Dead code
  Removed, each verified to have no non-test caller: promptSearchSelection
  (77 lines, superseded by promptSearchSelectionMenu), AddPlaylistByTrackIDs,
  download.NewWithVerifySSL, qobuz.Client.GetTrackMetadata,
  tidal.Client.trackSupportsAtmos (test-only, and the comment above
  GetDownloadable already documented its removal from the live path) and its
  now-orphaned test, yandex.canonicalTrackRequestID (a no-op returning its
  trimmed input; the call site uses strings.TrimSpace directly) and the unused
  defaultEstimatedKbps constant.

Config keys that did nothing
  qobuz.download_booklets and misc.check_for_updates were declared, defaulted
  and documented in config.toml.example but read by no code. The whole
  [youtube] block went too: there is no YouTube provider. go-toml ignores
  unknown keys, verified, so existing user configs still load.

Duplicated helpers
  tidal.stringify and yandex.firstNonEmpty were byte-identical copies of
  jsonutil.StringFromAny and jsonutil.FirstNonEmpty. displayArtistNames
  existed three times, byte-identical, in internal/app, provider/yandex and
  provider/beatport; it now lives in jsonutil. The CLI's normalizeCodec
  delegates to config.NormalizeCodec so the flag and the config file are
  checked by the same rules.

Tests for packages that had none
  internal/jsonutil (0% -> 100%) and internal/netutil (0% -> 78%), the latter
  covering redactURL, which is a security control, and the zero-timeout
  contract that internal/download and the qobuz body copy depend on.
  internal/config rose to 82% with coverage of the new Validate(), the
  0600 permissions, CloneConfigData not sharing slices, and a concurrent
  UpdateTokens test that exercises the mutex under -race.

Test suite is ~85x faster
  Provider tests built clients with the default 60 requests/minute, so the
  rate limiter slept 1s per HTTP call: deezer took 31s, tidal 11s, qobuz 8s.
  Each provider test package now builds its config through a testConfigData
  helper that disables throttling. Whole suite: ~60s -> 0.7s, and 2.8s
  under -race.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/provider/deezer/client_test.go

@@ -24,7 +24,7 @@ func TestSearchTrack(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
 
@@ -74,7 +74,7 @@ func TestGetMetadataArtistPaginatesAlbums(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
 
@@ -135,7 +135,7 @@ func TestGetMetadataAlbumPaginatesTracks(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
 
@@ -189,7 +189,7 @@ func TestGetMetadataPlaylistPaginatesTracks(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
 
@@ -241,7 +241,7 @@ func TestGetDownloadableNativeCipher(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	cfgData.Deezer.ARL = "arl"
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
@@ -289,7 +289,7 @@ func TestGetDownloadablePrefersNoneCipherWhenAvailable(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	cfgData.Deezer.ARL = "arl"
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
@@ -354,7 +354,7 @@ func TestLoginPrefersARLFlowOverRefreshShortcut(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	cfgData.Deezer.ARL = "arl"
 	cfgData.Deezer.RefreshToken = "refresh-token"
 	c := New(&config.Config{File: cfgData, Session: cfgData})
@@ -386,7 +386,7 @@ func TestLoginPrefersARLFlowOverRefreshShortcut(t *testing.T) {
 }
 
 func TestGetDownloadableRequiresARL(t *testing.T) {
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	cfgData.Deezer.ARL = ""
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
@@ -409,7 +409,7 @@ func TestGetDownloadableDRMError(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	cfgData.Deezer.ARL = "arl"
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
@@ -448,7 +448,7 @@ func TestGetTrackTokenPrefersPipeToken(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
 	c.jwt = "jwt-token"
@@ -499,7 +499,7 @@ func TestGetDownloadableUsesPipeTrackToken(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	cfgData.Deezer.ARL = "arl"
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
@@ -541,7 +541,7 @@ func TestGetMetadataAddsLyricsFromPipe(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
 	c.jwt = "jwt"
@@ -594,7 +594,7 @@ func TestLoginWithCredentials(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	cfgData.Deezer.Email = "tidal1@alpin.sbs"
 	cfgData.Deezer.Password = "tidal1@alpin.sbs"
 	c := New(&config.Config{File: cfgData, Session: cfgData})
@@ -662,7 +662,7 @@ func TestMobileAuthIncludesAppContextParams(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 
 	origGateway := gatewayURL
@@ -703,7 +703,7 @@ func TestMobileUserAutologIncludesRefreshToken(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.sid = "sid123"
 	c.userID = "42"
@@ -748,7 +748,7 @@ func TestLoginWithRefreshToken(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	cfgData.Deezer.RefreshToken = "refresh-token"
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 
@@ -782,7 +782,7 @@ func TestRefreshJWTHTTPError(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.refresh = "refresh-token"
 
@@ -802,7 +802,7 @@ func TestRefreshLicenseFromPipeGraphQLError(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.jwt = "jwt-token"
 
@@ -848,7 +848,7 @@ func TestRefreshLicenseFromPipeUsesMobileGraphQLShape(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	cfgData := config.DefaultConfigData()
+	cfgData := testConfigData()
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.jwt = "jwt-token"
 
@@ -863,3 +863,13 @@ func TestRefreshLicenseFromPipeUsesMobileGraphQLShape(t *testing.T) {
 		t.Fatalf("license = %q, want license-token", c.license)
 	}
 }
+
+// testConfigData returns defaults with request throttling disabled.
+//
+// At the default 60 requests/minute the rate limiter sleeps 1s per request,
+// which accounted for most of this suite's runtime (deezer alone was 31s).
+func testConfigData() config.ConfigData {
+	d := config.DefaultConfigData()
+	d.Downloads.RequestsPerMinute = -1
+	return d
+}