- Use MD5 hashing for image and Spotify cache keys instead of raw hex
encoding (rpc.go) and SHA-256 (spotify.go)
- Validate Spotify track IDs with base-62 regex before using in URLs
- Fix buildSpotifySearchURL parameter order to match (artist, title) usage
- Tighten test mock matchers with shared helpers for cache keys and
external-assets URLs, replacing broad mock.Anything usage
- Update test Spotify IDs to use valid base-62 identifiers
Remove the recursive fallback pattern from processImage (5 duplicated
branches) and replace with a straight-line flow that returns errors to
the caller. Move fallback orchestration to sendActivity, which now
tries track artwork first, falls back to the Navidrome logo, and only
shows the SmallImage overlay when LargeImage is actual track art.