feat(spotify): interactive setup wizard + docs page (#15130)

Previously 'hermes auth spotify' crashed with 'HERMES_SPOTIFY_CLIENT_ID
is required' if the user hadn't manually created a Spotify developer
app and set env vars. Now the command detects a missing client_id and
walks the user through the one-time app registration inline:

- Opens https://developer.spotify.com/dashboard in the browser
- Tells the user exactly what to paste into the Spotify form
  (including the correct default redirect URI, 127.0.0.1:43827)
- Prompts for the Client ID
- Persists HERMES_SPOTIFY_CLIENT_ID to ~/.hermes/.env so subsequent
  runs skip the wizard
- Continues straight into the PKCE OAuth flow

Also prints the docs URL at both the start of the wizard and the end
of a successful login so users can find the full guide.

Adds website/docs/user-guide/features/spotify.md with the complete
setup walkthrough, tool reference, and troubleshooting, and wires it
into the sidebar under User Guide > Features > Advanced.

Fixes a stale redirect URI default in the hermes_cli/tools_config.py
TOOL_CATEGORIES entry (was 8888/callback from the PR description
instead of the actual DEFAULT_SPOTIFY_REDIRECT_URI value
43827/spotify/callback defined in auth.py).

tests/hermes_cli/test_spotify_auth.py

@@ -86,3 +86,53 @@ def test_auth_spotify_status_command_reports_logged_in(capsys, monkeypatch: pyte
     output = capsys.readouterr().out
     assert "spotify: logged in" in output
     assert "client_id: spotify-client" in output
+
+
+
+def test_spotify_interactive_setup_persists_client_id(
+    tmp_path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys,
+) -> None:
+    """The wizard writes HERMES_SPOTIFY_CLIENT_ID to .env and returns the value."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    monkeypatch.setattr("builtins.input", lambda prompt="": "wizard-client-123")
+    # Prevent actually opening the browser during tests.
+    monkeypatch.setattr(auth_mod, "webbrowser", SimpleNamespace(open=lambda *_a, **_k: False))
+    monkeypatch.setattr(auth_mod, "_is_remote_session", lambda: True)
+
+    result = auth_mod._spotify_interactive_setup(
+        redirect_uri_hint=auth_mod.DEFAULT_SPOTIFY_REDIRECT_URI,
+    )
+    assert result == "wizard-client-123"
+
+    env_path = tmp_path / ".env"
+    assert env_path.exists()
+    env_text = env_path.read_text()
+    assert "HERMES_SPOTIFY_CLIENT_ID=wizard-client-123" in env_text
+    # Default redirect URI should NOT be persisted.
+    assert "HERMES_SPOTIFY_REDIRECT_URI" not in env_text
+
+    # Docs URL should appear in wizard output so users can find the guide.
+    output = capsys.readouterr().out
+    assert auth_mod.SPOTIFY_DOCS_URL in output
+
+
+def test_spotify_interactive_setup_empty_aborts(
+    tmp_path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Empty input aborts cleanly instead of persisting an empty client_id."""
+    monkeypatch.setenv("HERMES_HOME", str(tmp_path))
+    monkeypatch.setattr("builtins.input", lambda prompt="": "")
+    monkeypatch.setattr(auth_mod, "webbrowser", SimpleNamespace(open=lambda *_a, **_k: False))
+    monkeypatch.setattr(auth_mod, "_is_remote_session", lambda: True)
+
+    with pytest.raises(SystemExit):
+        auth_mod._spotify_interactive_setup(
+            redirect_uri_hint=auth_mod.DEFAULT_SPOTIFY_REDIRECT_URI,
+        )
+
+    env_path = tmp_path / ".env"
+    if env_path.exists():
+        assert "HERMES_SPOTIFY_CLIENT_ID" not in env_path.read_text()