fix: validate Party tracks in host market and collapse invitations

[amitbreuer]

Summary

• Explicitly request market=from_token for Spotify search and direct track metadata so pre-delivery validation receives host-market playability evidence.
• Retain fail-closed checks for missing/false playability, restrictions, local/relinked tracks, changed IDs and recording drift.
• Make the host Invite friends card collapsed by default using native details/summary. Preserve QR, invitation URL and copy actions; hide the card for guests and ended rooms.
• Cover direct Spotify canonical URLs, si/context query parameters, intl-de and intl-pt-BR URLs through signed selection and PostgreSQL-backed delivery. No parser defect was found in those forms; the exact failing user URL is not known.

Evidence and limitations

• Read-only production inspection found selected songs rejected as track_unavailable before any delivery attempt or queue write.
• Spotify documentation describes market-dependent playability fields; a regression reproduces omitted is_playable without explicit market and fails before the fix.
• Provider and integration tests verify positive unchanged evidence reaches exactly one mocked queue 204, with no resend on task replay. Unknown or conflicting evidence still causes no write.
• This is documented-contract and mocked-provider evidence, not confirmation from affected live Spotify responses: the host token was expired and no live Spotify calls or refresh were performed.

Validation reported by implementation session

• All five workspace builds, 111 tests (42 provider, 20 API, 21 native PostgreSQL, 28 frontend), and focused lint pass.
• Browser startup remains blocked by Chrome timeout and headless Chromium SIGSEGV. DOM coverage and HTTP previews are not proof of actual rendered browser/keyboard behavior.

Previews

• Host: http://127.0.0.1:5221/app/?section=party&demo=host
• Guest: http://127.0.0.1:5221/app/?section=party&demo=guest
  Both respond over HTTP; they are local development fixtures, not live Telegram/provider verification.

Rollout

No production writes, deployment, merge or real enqueue. Existing unavailable jobs are completed and will not automatically retry. After deployment, search/select again to verify live behavior.