Fix credential persistence deadlock and bound login network waits

[ameel]

OAuth login can hang indefinitely at several points, and credential persistence deadlocks after Spotify has already accepted the session.

The deadlock occurs in __authenticate_partial(): it receives and stores APWelcome, then calls credentials() before releasing the authentication condition. credentials() calls ap_welcome(), which waits on that same condition, so the login thread waits on itself. This change reads the already-received welcome packet directly while persisting reusable credentials.

The change also:

• adds bounded timeouts to AP resolution, socket connection, session authentication, token exchange, and token refresh;
• closes failed sockets and the local OAuth callback server reliably;
• copies the shared OAuth request-data mapping before mutation, preventing authorization and refresh requests from contaminating one another.

Validation:

• regression tests cover credential access during unfinished authentication, missing-welcome handling, resolver and connection timeouts, failed authentication cleanup, OAuth request timeouts, and callback-server cleanup;
• performed a complete OAuth login against Spotify;
• downloaded and converted a full track successfully after the fix;
• launched a second session using the persisted credentials without browser authorization.