[streambinder]

Summary

The Qobuz provider resolved stream URLs through the dabmusic.xyz proxy. That proxy now sits behind a Cloudflare challenge for non-browser clients, so every resolution failed. provider.Search swallowed the failure unless all providers failed at once, so the sync reported the track as not found.

This PR changes the following:

• provider.Search aggregates each provider failure, prefixed with the provider name, and returns the error alongside the matches. Sync prints a provider warning when other providers still produced a match, and a search failure when none did. Lookup prints the same warning.
• Qobuz stream URLs are resolved through the official track/getFileUrl endpoint, authenticated with the user token from the QOBUZ_TOKEN environment variable.
• The two API stages use the app that authorizes each: catalog search keeps the open.qobuz.com embed app credentials (unsigned search works there, and the web player app refuses unsigned catalog calls with 401). Stream resolution uses the production app ID scraped from the play.qobuz.com web player bundle, plus a signing secret derived from the bundle seed data: the secret printed in the bundle config does not sign, so the provider derives the candidate secrets, tries them in order against the signature check, and remembers the accepted one. Under the embed app, getFileUrl answers UserUnauthenticated and serves samples even with a valid user token.
• A sample-only response is rejected with an explicit error that carries the API restriction codes. A missing token is an explicit error too. The dabmusic proxy is removed.
• A YouTube search page with no video results (for example a degraded page served to non-browser clients) is a provider error, not a silent zero-match answer.

Verification

• Full test suite green on all packages.
• Live checks against the real Qobuz services: the catalog search resolves the track; the credential scrape reads the production web player app ID from the live play.qobuz.com bundle and derives its candidate secrets; a getFileUrl call signed with the derived secret passes the API signature check (it answers 401 with a dummy user token, where wrong secrets answer 400 Invalid Signature).
• The authenticated happy path needs a real user token. It is covered by stubbed HTTP stage tests, not by a live run.

[streambinder]

Superseded by #274: Qobuz support is being dropped entirely instead of moved to the direct API.