Add Spotify artwork to MCP resource responses

[austin-smith]

Summary

• add opt-in include_artwork support to the MCP get_resource tool for tracks and albums
• return original Spotify-hosted image bytes as an MCP image content block alongside metadata, attribution, and an Open Spotify link
• bound artwork downloads by approved CDN hosts, redirects, timeout, payload size, and validated image type
• document the capability and cover default, error, redirect, payload, MIME, attribution, and byte-preservation behavior

Why

Spotify resource metadata exposed album details but the MCP result discarded the image data, so clients could not directly show album art. This keeps artwork opt-in and attached to the existing resource response while preserving the text-only default.

Validation

• bun test — 1,055 passed
• bun run typecheck
• bun run engine:test — 28 passed
• cargo fmt --manifest-path native/Cargo.toml --check
• cargo clippy --manifest-path native/Cargo.toml --all-targets -- -D warnings
• git diff --check