Reject a wrong Client ID or Secret before the Spotify redirect

[Mincka]

Problem

Home Assistant stores application credentials outside the config entry and never validates them. A typo in the Client ID or Secret sends the user to Spotify's own INVALID_CLIENT page, the browser is never redirected back, and the flow sits on the external step until it times out. No config entry exists at that point, so there is nothing for a repair or a reauth to attach to, and reinstalling Spotcast does not bring the credentials form back because the bad pair stays in HA's store (#73).

Fix

• async_step_auth now validates the stored pair with a client-credentials token request before generating the authorize URL. A 400 invalid_client answer aborts the flow with a new invalid_credentials message linking to the Application credentials panel (My Home Assistant redirect) and to the docs. Anything else (network error, 429, 5xx, odd payload) falls through so a Spotify hiccup never blocks setup. Reauth uses the same step, so a rotated secret is covered too.
• The first setup screen links to the reset instructions.
• New "Changing or resetting the application credentials" section in the configuration guide, with a README pointer and a changelog entry.
• Translations updated in en/fr/de (placeholder parity test green).

Verification

• Full unit suite: 822 tests green, pylint 10.00 on the handler.
• The helper was probed against the real Spotify token endpoint: a bogus ID and a bogus secret both come back 400 invalid_client; an offline session is reported as not rejected.
• Not exercised through a real HA config flow (no local HA container available).

Fixes #73

🤖 Generated with Claude Code