Migrate from Implicit Grant Flow to Authorization Code with PKCE

[watsonbox]

https://developer.spotify.com/blog/2025-02-12-increasing-the-security-requirements-for-integrating-with-spotify https://developer.spotify.com/documentation/web-api/tutorials/migration-implicit-auth-code

On 27 November 2025, Spotify will remove support for the implicit grant flow, as well as HTTP redirect URIs and localhost aliases in our OAuth offering.
These features could pose a security risk to Spotify users and partners and we are therefore enforcing the new rules before the end of the year.

This PR migrates to the new auth flow, switches to storing the access token in local browser storage (rather than in the URL), and extracts auth code to a separate file since it has now become more complex.