feat(core): the metadata clients accept a client, a base URL and a key #263

Step A of the plan in docs/metadata-enrichment-plan.md, which implements RFC-011.

The pull request lands in InstaZDLL/WaveFlow, in waveflow-core. It is filed here because everything else in the plan waits for it.

Why the server cannot use the clients as they are

LastfmClient::new() and TheAudioDbClient::new() each build their own reqwest::Client:

• the default redirect policy, which follows up to ten — RFC-011 decision 9 follows none, and this server already has scrobblers::outbound_client built with Policy::none();
• a .json() read with no ceiling on the body — decision 9 bounds it;
• a constant base URL — right for production, and the reason this server's hermetic suite could test none of it: the scrobbling tests reach their fakes by pointing a destination at a local listener, and a metadata base URL is not a setting.

And TheAudioDB builds {BASE_URL}/{FREE_API_KEY}/search.php with FREE_API_KEY = "123", with no way to pass another key. Decision 3 refuses that key for a server.

What changes

• with_http(client, base_url) beside the existing new() on the Last.fm, TheAudioDB and Deezer clients. new() keeps today's behaviour, so the desktop changes nothing.
• TheAudioDB's key becomes a field; new() keeps "123".
• The body is read through a ceiling before it is parsed.
• Worth asking for in the same move, since the server's pin will move only once: artist.getInfo by MusicBrainz id. ArtistItem already carries musicbrainz_id, and an MBID has no homonyms.

Done when

The desktop's own tests pass unchanged, and a test in the core reaches each client through with_http against a local listener — including one that answers a 302 and one whose body exceeds the ceiling.