feat: optional direct Bandcamp/Apple/YouTube links via Odesli (flag-gated) (closes task/odesli-direct-cross-platform-links)

Source: task/odesli-direct-cross-platform-links (plan/improvement-backlog) — bandcamp was only a Google search; Odesli gives direct cross-platform links for Spotify-resolved names.

- service/odesli.js: makeOdesli({fetch,baseUrl}) -> getLinks(spotifyUrl); pure parseOdesli core; bounded AbortSignal.timeout; non-200/timeout/garbage -> {} (graceful).
- resolver.js: opt-in ODESLI / ODESLI_URL flag (default OFF). When ON, enrich each Spotify-resolved result with additive bandcamp/appleMusic/youtube fields (isHttpUrl-validated), cached per Spotify url. OFF -> no call, byte-identical behavior. /health + startup log surface the flag.
- extension: a tiny additive "bc" link to a direct Bandcamp page when result.bandcamp is present (reuses isSafeHttpUrl); primary artist/album/spotify/google rendering unchanged. styles.css: bandcamp-teal secondary link.
- odesli.test.js + odesli.fixture.json: parseOdesli unit-tested against a real captured Odesli response (Blood Incantation album -> direct bandcamp; absent apple/youtube omitted; junk -> {}); getLinks 200/non-200/throw/parse-error paths.
- docs: .env.example, README, AGENTS.md note the opt-in flag.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

service/.env.example

@@ -13,6 +13,17 @@ SPOTIFY_CLIENT_SECRET=
 # OLLAMA_URL=http://localhost:11434
 # OLLAMA_MODEL=qwen2.5:3b
 
+# Optional direct Bandcamp/Apple/YouTube links via Odesli (song.link) — opt-in, default OFF.
+# When ON, an ALBUM result that resolved to a DIRECT Spotify url (the creds path above) is enriched
+# with the album's DIRECT cross-platform links from the free, no-auth Odesli API, so the extension
+# can offer a direct Bandcamp link instead of a Google search. Album results only — Odesli rejects
+# artist urls (405), so artist results are skipped (no wasted call). Needs the Spotify gate to have
+# produced a url to enrich (the no-creds Google fallback path is untouched). Bounded + graceful:
+# Odesli down/timeout/garbage keeps the current result. When OFF, no Odesli call is made and
+# behavior is unchanged. Set ODESLI=1 to enable; ODESLI_URL overrides the endpoint (also enables it).
+# ODESLI=1
+# ODESLI_URL=https://api.song.link/v1-alpha.1
+
 # Port the resolver listens on (default 8787). If you change it, also update RESOLVER_URL in
 # extension/background.js and the host in extension/manifest.json permissions.
 PORT=8787