[feat] SIMKL AUTH V2 (device flow and refresh tokens)

[cenodude]

Problem to solve

SIMKL is retiring AUTH V1 at the end of March 2027. After that, the current PIN login and old OAuth keys stop working. V1 tokens can not be converted, so every SIMKL user has to reconnect.

Proposal

• Move PIN connect to the V2 device flow with a new baked CrossWatch client id (public, safe to commit)
• Move OAuth (own keys) to V2 with PKCE. Users need a new V2 "Server apps & services" app
• Add token refresh. V2 access tokens last 7 days and refresh tokens last 180 days
  • background check every hour
  • refresh before sync and scrobble
  • retry once on 401 in the status check
• Revoke the login on SIMKL when disconnecting
• Keep V1 logins working until the sunset and show a reconnect warning in the UI

Area

• Watchlist
• Ratings
• History
• Playlists
• Scrobble watcher
• Scrobble webhook
• Scheduler
• Analyzer, Events, Exporter
• Web UI
• Command line interface
• Config/API