feat(mdblist): sync watched history, scrobbles and ratings with MDBList

Connects MDBList through its OAuth device-code grant, registered as a
Device Code app so no client secret or redirect URI ships in the binary
and TV, mobile and desktop all use the same flow.

MDBList omits `verification_uri_complete`, but its device page seeds the
code field from a `user_code` query parameter and the sign-in redirect
preserves the query string, so the activation link is built locally and
the dialog's open button lands on a filled-in form instead of an empty
one. A server-supplied complete URL still wins if one ever appears.

Poll state is read from the response body rather than the status code:
`authorization_pending` and `slow_down` both arrive as HTTP 400, and a
missing grant answers 404 `device_not_found`.

Writes go out as real-time `/scrobble/*` reports plus `/sync/watched`
for the marks that never pass through the player, with ratings on
`/sync/ratings`. Matching uses IMDb and TMDb only — MDBList's id block
has no `tvdb` field, so a TVDB-only item is skipped rather than written
under an empty id block.

lib/widgets/catalog_source_logo.dart

@@ -24,6 +24,7 @@ class CatalogSourceLogo extends StatelessWidget {
       CatalogSourceId.anilist => 'assets/anilist_mark.svg',
       CatalogSourceId.simkl => 'assets/simkl_mark.svg',
       CatalogSourceId.seerr => 'assets/seerr_mark.svg',
+      CatalogSourceId.mdblist => 'assets/mdblist_mark.svg',
     };
     final color = IconTheme.of(context).color ?? Theme.of(context).colorScheme.onSurface;
     return SvgPicture.asset(