feat(psn): link PlayStation account and import played games

The NPSSO is used once to get a refresh token; only that token is
stored, sealed with AES-GCM (SecretBox, key APP_PSN_TOKEN_KEY; no key
= feature off). One-time import of played PS4/PS5 titles through the
import pipeline as source PSN. Unlink keeps the games. One PSN call
per user at a time. IGDB search now sends UTF-8, so non-ASCII names
like "Yōtei" match again.

src/main/resources/application.yml

@@ -51,6 +51,15 @@ app:
     client-secret: ${IGDB_CLIENT_SECRET:}
     base-url: https://api.igdb.com/v4
     token-base-url: https://id.twitch.tv
+  psn:
+    # Base64 of 32 random bytes (openssl rand -base64 32). Empty = the PlayStation link is off.
+    token-key: ${APP_PSN_TOKEN_KEY:}
+    auth-base-url: https://ca.account.sony.com/api/authz/v3/oauth
+    api-base-url: https://m.np.playstation.com/api
+    # The public client of the PlayStation app, as the psn-api project ships it. Not a secret of ours.
+    client-id: 09515159-7237-4370-9b40-3806e67c0891
+    client-secret: ucPjka5tntB2KqsP
+    redirect-uri: com.scee.psxandroid.scecompcall://redirect
   speedrun:
     # No key needed. false stops every call to speedrun.com.
     enabled: true
@@ -126,4 +135,10 @@ resilience4j:
         # IGDB allows 4 requests/s. Taken per HTTP request.
         limit-for-period: 4
         limit-refresh-period: 1s
-        timeout-duration: 10s
+        timeout-duration: 10s
+      psnApi:
+        # Unofficial API; third-party tools limit themselves to about 300 requests / 15 min. One request every 4 s
+        # for the whole server, taken per HTTP request.
+        limit-for-period: 1
+        limit-refresh-period: 4s
+        timeout-duration: 30s