fix(cli): validate spotdl sync manifests

[labithiotis]

Summary

• decode spotDL sync files before reading query or song fields
• prefer validated collection URLs from song metadata and reject raw searches, keywords, and unsupported collection kinds
• normalize Spotify collection URIs to provider-compatible HTTPS URLs
• process multiple spotDL files in stable filename order and skip invalid files
• remove fabricated album/song ID fallbacks

Test plan

• bun test src (80 pass)
• bun run typecheck
• biome check
• repository pre-commit hooks