fix: address code review issues for Spotify and Discord RPC

- Use MD5 hashing for image and Spotify cache keys instead of raw hex
  encoding (rpc.go) and SHA-256 (spotify.go)
- Validate Spotify track IDs with base-62 regex before using in URLs
- Fix buildSpotifySearchURL parameter order to match (artist, title) usage
- Tighten test mock matchers with shared helpers for cache keys and
  external-assets URLs, replacing broad mock.Anything usage
- Update test Spotify IDs to use valid base-62 identifiers

rpc.go

@@ -6,6 +6,8 @@
 package main
 
 import (
+	"crypto/md5"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"strings"
@@ -130,7 +132,8 @@ func (r *discordRPC) processImage(imageURL, clientID, token string, ttl int64) (
 	}
 
 	// Check cache first
-	cacheKey := fmt.Sprintf("discord.image.%x", imageURL)
+	h := md5.Sum([]byte(imageURL))
+	cacheKey := "discord.image." + hex.EncodeToString(h[:8])
 	cachedValue, exists, err := host.CacheGetString(cacheKey)
 	if err == nil && exists {
 		pdk.Log(pdk.LogDebug, fmt.Sprintf("Cache hit for image URL: %s", imageURL))