fix: address review feedback (CR1, CR2, CR4, CR5)

- AccountHelper: move player-prefs cleanup outside if($userId) guard
  so bindings are cleared even when credentials.json is missing
- API: restore browse/* to token-scoped cache key to prevent
  personalized responses leaking between accounts
- Token: also remove legacy 3-segment RT key in removeRefreshToken
  to prevent re-migration of deleted tokens
- strings.txt: fix Dutch typo browsmenu → browsemenu

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stiefenm

API.pm

@@ -1266,10 +1266,7 @@ sub _callOneShot {
 	my $cached;
 	my $cache_key;
 	if (!$params->{_nocache} && $type eq 'GET') {
-		# Strip the bearer from the cache key for non-me/* URLs so own-flavor and
-		# bundled-flavor browse responses share a single cache row. `me/*` continues
-		# to scope by token (different users see different Liked Songs).
-		$cache_key = md5_hex($url . ($url =~ /^me\b/ ? $token : ''));
+		$cache_key = md5_hex($url . ($url =~ /^(?:me|browse)\b/ ? $token : ''));
 	}
 
 	main::INFOLOG && $log->is_info && $cache_key && $log->info("Trying to read from cache for $url");

API/Token.pm

@@ -184,7 +184,14 @@ sub removeRefreshToken {
 	}
 	main::INFOLOG && $log->is_info && $log->info("Removing refresh token for $userId (flavor=$flavor).");
 	eval { $spottyCache->remove(_getRTCacheKey($code, $userId, $flavor)) };
-	$log->warn("removeRefreshToken: cache layer threw on remove for $userId (flavor=$flavor): $@") if $@;
+	$log->warn("removeRefreshToken: new-key remove failed for $userId (flavor=$flavor): $@") if $@;
+	if ($flavor eq 'own') {
+		my $legacyKey = _getRTCacheKeyLegacy($code, $userId);
+		eval { $spottyCache->remove($legacyKey) };
+		$log->warn("removeRefreshToken: legacy spottyCache remove failed for $userId: $@") if $@;
+		eval { $cache->remove($legacyKey) };
+		$log->warn("removeRefreshToken: legacy cache remove failed for $userId: $@") if $@;
+	}
 }
 
 # singleton shortcut to the main class

AccountHelper.pm

@@ -216,18 +216,19 @@ sub deleteCacheFolder {
 		# (a) Refresh-token cache scrub — both flavors.
 		Plugins::Spotty::API::Token->removeRefreshToken(undef, $userId, 'own');
 		Plugins::Spotty::API::Token->removeRefreshToken(undef, $userId, 'bundled');
+	}
 
-		# (b) Player-prefs scrub — iterate live roster, remove 'account' binding from any
-		# client whose account == the deleted $id. Mirrors setAccount / getAccount primitive.
-		foreach my $client ( Slim::Player::Client::clients() ) {
-			next unless $client;
-			my $bound = $prefs->client($client)->get('account');
-			next unless defined $bound && $bound eq $id;
+	# (b) Player-prefs scrub — iterate live roster, remove 'account' binding from any
+	# client whose account == the deleted $id. Matches on $id (always available), not
+	# $userId, so it runs even when credentials.json is missing/corrupt.
+	foreach my $client ( Slim::Player::Client::clients() ) {
+		next unless $client;
+		my $bound = $prefs->client($client)->get('account');
+		next unless defined $bound && $bound eq $id;
 
-			$prefs->client($client)->remove('account');
-			$client->pluginData( api => '' );
-			main::INFOLOG && $log->is_info && $log->info("Cleared player account binding: client=" . $client->id . " (was bound to $id)");
-		}
+		$prefs->client($client)->remove('account');
+		$client->pluginData( api => '' );
+		main::INFOLOG && $log->is_info && $log->info("Cleared player account binding: client=" . $client->id . " (was bound to $id)");
 	}
 
 	$class->purgeCache();

strings.txt

@@ -1200,7 +1200,7 @@ PLUGIN_SPOTTY_BUNDLED_AUTH_NEEDED_SUMMARY
 	EN	Some accounts need additional authorization to enable the full browse menu (Mix of the Week, Release Radar, Discover Weekly etc.).
 	FR	Certains comptes nécessitent une autorisation supplémentaire pour activer le menu de navigation complet (Mix de la semaine, Release Radar, Discover Weekly, etc.).
 	HU	Néhány fiókhoz további engedélyezés szükséges a teljes böngészési menü aktiválásához (Heti mix, Release Radar, Discover Weekly stb.).
-	NL	Sommige accounts hebben aanvullende autorisatie nodig om het volledige browsmenu te activeren (Mix van de week, Release Radar, Discover Weekly enz.).
+	NL	Sommige accounts hebben aanvullende autorisatie nodig om het volledige browsemenu te activeren (Mix van de week, Release Radar, Discover Weekly enz.).
 
 PLUGIN_SPOTTY_BUNDLED_AUTH_LINK_LABEL
 	CS	Autorizovat procházení