Resolve five spec contradictions (PKCE, Authenticator, fatal-retry, prompts, user-auth)

[joestump]

Part of #304 (EPIC: Spec Governance Cleanup). Extends #312 (user-auth contradiction — the audit pinned it to exact REQs). Governing: SDD spec hygiene; each item is an audit CRITICAL unless noted.

Five spec-vs-spec (or spec-internal) contradictions where two normative statements cannot both hold. Each resolution must pick a winner, amend the loser, and note the decision:

Requirements

• Spotify PKCE: music-provider-integration REQ-PROV-031 mandates OAuth2 PKCE; user-authentication describes (and code implements) a PKCE-less authorization-code flow with client secret (internal/providers/spotify/spotify.go:75-97). Decide: implement PKCE or amend REQ-PROV-031
• Navidrome Authenticator: REQ-PROV-052 says Navidrome MUST NOT implement Authenticator; REQ-PROV-005 requires SupportsAuth() == false (which requires implementing it). Code implements it with SupportsAuth()=false and a comment acknowledging the deviation (internal/providers/navidrome/navidrome.go:36-71)
• Fatal-retry-on-restart: error-handling REQ-STATE-004 ("fatal MUST NOT be retried automatically; cleared only by user action") vs REQ-STATE-002 + Scenario 5 (in-memory-only state; restart retries immediately). Either persist the fatal flag or soften REQ-STATE-004
• Prompt policy: vibes REQ-VIBES-013 forbids hardcoded prompts; similar-artists REQ-SIM-011 requires the hardcoded-fallback pattern; generator.go:566-590 implements the fallback. Pick one policy for both specs (coordinate with Deduplicate mixtape generation; unify vibes fuzzy matching with track matcher #340)
• user-authentication (extends Story: Fix user-authentication spec internal contradiction + stale refs #312): REQ-SESSION-001 (cookie = signed JWT) vs REQ-MIDDLEWARE-003 (middleware queries User "by username from the cookie value"). Code validates JWT + looks up by claims.UserID (cmd/server/main.go:699-706) — rewrite REQ-MIDDLEWARE-003 to match; also fix the stale line refs (spec pins main.go:360-389; actual 663-716) and the "queries the PostgreSQL" overview wording

Acceptance Criteria

• No pair of accepted artifacts makes contradictory normative claims (re-run /sdd:audit category 3 clean on these five)
• Each amendment references the resolving decision in the spec changelog/frontmatter

Branch

feature/350-resolve-spec-contradictions

PR Convention

PR title references the story; body ends with Closes #350, references the parent epic and governing artifacts above.

🤖 Posted on behalf of @joestump by Claude.