fix: address code review issues for Spotify and Discord RPC

- Use MD5 hashing for image and Spotify cache keys instead of raw hex
  encoding (rpc.go) and SHA-256 (spotify.go)
- Validate Spotify track IDs with base-62 regex before using in URLs
- Fix buildSpotifySearchURL parameter order to match (artist, title) usage
- Tighten test mock matchers with shared helpers for cache keys and
  external-assets URLs, replacing broad mock.Anything usage
- Update test Spotify IDs to use valid base-62 identifiers

plugin_suite_test.go

@@ -1,13 +1,22 @@
 package main
 
 import (
+	"strings"
 	"testing"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	"github.com/stretchr/testify/mock"
 )
 
 func TestDiscordPlugin(t *testing.T) {
 	RegisterFailHandler(Fail)
 	RunSpecs(t, "Discord Plugin Main Suite")
 }
+
+// Shared matchers for tighter mock expectations across all test files.
+var (
+	discordImageKey   = mock.MatchedBy(func(key string) bool { return strings.HasPrefix(key, "discord.image.") })
+	externalAssetsURL = mock.MatchedBy(func(url string) bool { return strings.Contains(url, "external-assets") })
+	spotifyURLKey     = mock.MatchedBy(func(key string) bool { return strings.HasPrefix(key, "spotify.url.") })
+)