fix: harden device, config, and Spotify reliability

[zzwong]

Summary

• resolve Cast timeout configuration once and make relative volume changes single-read and overflow-safe
• bound WiiM and Spotify response bodies and surface config-path failures consistently
• make Spotify OAuth callback handling single-shot, state-safe, flushed, and gracefully shut down
• run command/skill consistency checks for documentation-only changes
• retain and document fixed-argument browser launcher gosec annotations

Notable behavior

• upward relative volume still rejects targets over maxVolume; downward changes safely clamp at zero
• device-reported volume must be within 0–100
• wrong-state OAuth callbacks return 400 without preventing the valid callback
• timeout values that cannot fit time.Duration are rejected

Verification

• gofmt -l . (clean)
• go vet ./...
• go test -race ./...
• golangci-lint run ./... (0 issues)

Reviews

• task-level spec and code-quality reviews passed
• final full-diff spec review passed
• final full-diff quality review approved
• adversarial review found volume overflow/range, timeout conversion, and wrong-state callback issues; all were fixed in 8c560c8
• adversarial re-review: CLEAN