fix: resolve Party catalog permissions and simplify Spotify start

[amitbreuer]

Summary

• Remove market=from_token from Spotify search only. Keep it on direct track lookup, retaining playability and recording checks without expanding OAuth scopes.
• Distinguish catalog permission failures from playback permission failures so catalog errors do not incorrectly block the room as missing playback consent.
• Remove the Premium checkbox/API confirmation gate and unnecessary setup copy; Start party proceeds directly to Spotify authorization. Spotify still enforces its own playback eligibility.
• Add sanitized queue failure diagnostics for request phase, HTTP status, allowlisted transport error code and delivery outcome, without logging credentials or raw provider bodies.

Confirmed evidence

Read-only live diagnosis reported the same Spotify search returning 403 with market=from_token and 200 with playable results without it; direct track lookup with market returned 200. This addresses the reproduced catalog permission failure.

Unresolved queue issue

The root cause of existing unknown queue outcomes is NOT confirmed or fixed by this PR. Added diagnostics are intended to capture evidence from the next user-authorized attempt after deployment. Only confirmed 204 counts as added; ambiguous writes are not automatically retried or cleared. Do not describe this PR as fixing all playback failures.

Validation reported by implementation session

• All five workspace builds, 122 tests (45 provider, 20 API, 23 native PostgreSQL, 34 frontend), focused lint and diff checks passed.
• Actual browser verification is blocked by Chrome/headless startup failures. HTTP preview responds, not a substitute for rendering or keyboard verification.
• Preview: http://127.0.0.1:5225/app/?section=party&demo=host

Coordination and rollout

No live Spotify queue writes, production DB mutations, or cloud changes were performed by the implementation. The coordinating session has user authorization to merge after checks and monitor deployment; this PR handoff does not merge or deploy independently.