harden search parsing and qobuz refresh validation

internal/provider/qobuz/client_test.go

@@ -373,3 +373,15 @@ func qobuzSecretSig(requestTS, secret string) string {
 	hash := md5.Sum([]byte(raw))
 	return hex.EncodeToString(hash[:])
 }
+
+func TestRefreshAppCredentialsRejectsEmptyData(t *testing.T) {
+	d := config.DefaultConfigData()
+	c := New(&config.Config{File: d, Session: d})
+	c.fetchCfg = func(context.Context) (string, []string, error) {
+		return "", []string{" "}, nil
+	}
+	err := c.refreshAppCredentials(context.Background(), &c.cfg.Session.Qobuz)
+	if err == nil {
+		t.Fatalf("expected error for empty refreshed app credentials")
+	}
+}