feat: Spotify integration (Client Credentials / API key auth)

[harshithmullapudi]

Summary

• Adds a new Spotify integration following the existing resend API-key pattern
• Auth uses Client Credentials (Client ID + Client Secret) — no user OAuth flow
• Access is scoped to the public Spotify catalog (tracks, artists, albums)

Changes

Path	What
integrations/spotify/	New integration package
integrations/spotify/src/account-create.ts	Validates credentials via Spotify token endpoint; stores client_id + client_secret in config
integrations/spotify/src/index.ts	SpotifyCLI with api_key auth spec (two fields: Client ID, Client Secret)
integrations/spotify/src/mcp/index.ts	8 MCP tools: search_tracks, get_track, search_artists, get_artist, get_artist_top_tracks, search_albums, get_album, get_album_tracks
apps/webapp/app/components/icons/spotify.tsx	Spotify SVG icon component
apps/webapp/app/components/icon-utils.tsx	Register spotify in ICON_MAPPING
docs/toolkit/spotify.mdx	Setup guide and tool reference

Auth pattern followed

Mirrors resend integration exactly:

```typescript
auth: {
api_key: {
fields: [
{ name: 'client_id', label: 'Client ID', ... },
{ name: 'client_secret', label: 'Client Secret', ... },
],
},
},
```

`account-create.ts` calls `POST https://accounts.spotify.com/api/token\` (Client Credentials grant) to validate credentials before saving, identical in structure to how `resend` validates its API key.

Credential storage

`config: { client_id, client_secret }` — stored in `IntegrationAccount.config` via the standard `{ type: 'account', data: { ... } }` return, consistent with all other integrations.

MCP tools (8 total)

`search_tracks` · `get_track` · `search_artists` · `get_artist` · `get_artist_top_tracks` · `search_albums` · `get_album` · `get_album_tracks`

Each tool fetches a fresh access token (Client Credentials) before calling the Spotify Web API — tokens are short-lived (1 h) and not persisted.

Test plan

• Connect integration in CORE UI with a valid Spotify Developer app (Client ID + Secret)
• Verify connection succeeds and account is saved
• Verify connection fails with invalid credentials
• Call `search_tracks` MCP tool and confirm results return
• Call `get_artist_top_tracks` and confirm results return
• Toggle integration enabled/disabled and verify behavior is consistent with other integrations

🤖 Generated with Claude Code