fix: derive Spotify OAuth redirect URI from the request origin

[atomantic]

Summary

• The Settings > Spotify panel told users to register http://localhost:5555/api/spotify/oauth/callback even when they had reached PortOS over a remote HTTPS hostname, so the redirect URI never matched what the browser would actually hit and the OAuth round-trip failed.
• getRedirectUri() now takes an explicit { origin }, and every Spotify route passes the origin of the request it is serving (x-forwarded-proto/x-forwarded-host first, then req.protocol/host). Authorize URL, callback token exchange, saved credentials, and the status payload all resolve to the same string.
• Precedence is unchanged at the top and bottom: SPOTIFY_REDIRECT_URI still wins verbatim, and the PUBLIC_HOST / host-detection / localhost fallbacks stay for callers with no request context. .env.example is updated to describe the new order.

Test plan

• server/routes/spotify.test.js (new) — asserts the status and authorize routes forward the forwarded-origin to the service layer.
• server/services/spotifyAuth.test.js — new case for an explicit origin, including trailing-slash normalization; existing precedence cases still pass.
• cd server && npm test — 35356 passed, 0 failed. Three imageGen.* suites and sprites/atlas hit the 10s hook/test timeout under full-suite load; all four pass in isolation and are unrelated to this change.
• node scripts/generate-api-route-catalog.js regenerates apiRouteCatalog.generated.json with no further diff (the committed change is line-number shifts only).