feat(hosted): run hosted upload from the app config (#140) - #304

What changed

Last app-side slice of the #140 desktop uploader: the running app can now push to the hosted card service.

• config.json gets an optional hosted: { enabled, url? }. Off by default, and absent from configs that don't set it, so existing installs are unchanged. url must be HTTPS (defaults to https://nowplaying-hosted.vercel.app). Unknown keys make the config invalid, same as the rest of the file.
• startHostedFromConfig starts the loop from feat(hosted): credential store and polling loop for hosted uploads (#140) #297 with the uploader from feat(hosted): desktop uploader client for hosted cards (#140) #295. With no credential store it reports no_credentials instead of starting.
• startAppFromConfig takes hostedCredentials; the Windows entry passes the Credential Manager store. It returns hosted status and hostedCardUrl(), and stops the loop on close.
• The status snapshot gains hosted: { enabled, state, lastSuccessAt, error } (allow-listed words only, no tokens or IDs).
• Hosted upload runs apart from Discord: an offline host never touches presence.

The settings toggle and card link UI are tracked in #290 (web UI lane).

Checks

• Tests pass locally
• No secrets, tokens, server URLs, or personal media data are committed
• Docs or tests were updated when behavior changed
• The change is scoped to one roadmap issue

Issue

Part of #140