fix: 0.6.1 — OAuth loopback bind, feed lists, library refresh

[Nxssie]

The 0.6.1 batch.

OAuth loopback (the reported bug)

• The sign-in listener bound to localhost by name, which went through the system resolver, so a phone with a broken Private DNS or a network blocking plain DNS failed the sign-in before the browser even opened, reported as a DNS error. It now binds by address; the redirect URI keeps the name and the browser resolves it on its own.

Feed

• A shelf that carries tracks (weekly discovery, quick picks) renders as one card that opens a navigable list; playback starts only from an explicit tap on a track or on play_all there. Tapping a card used to start the queue at once. Cards can travel with their track list, so a shelf built from data already in hand does not round-trip through collectionTracks.
• The Android feed header stretched to a fifth of the screen with a long card title: the title had no weight, so it took the whole row and play_all wrapped one letter per line in the sliver left over. The title now flexes and ellipsizes and the action never wraps.

Library

• A list older than a minute is read again when the screen is entered, and pull-to-refresh forgets every cached list and re-reads the one on screen, so a like or playlist edit made on the platform itself no longer hides behind the ten-minute cache.
• Hearts are no longer offered as a control for SoundCloud. Its bot protection (DataDome) refuses writes from anything but its own player — every attempt from a phone, with the sign-in cookie, a browser user agent, the session's own client id, a hidden WebView and a visible captcha screen, ended in a hard block — and refused writes carrying a real token are a signal against the account. Likes are still read. The whole write path is preserved on feat/soundcloud-like-writes for when that changes.

Release tooling

• desktop/build.gradle.kts bumped to 0.6.1 so the CI packages carry the same version the APK reports from the tag.

🤖 Generated with Claude Code