feat(deploy): provision the web player client in development too

The web player's OIDC app had to be created by hand in the Zitadel console and
its client id copied into web-player/.env. provision.ps1 now creates both apps,
regenerates the client secret when it is no longer known, and wires the values
into deploy/.env, Musify.Api user-secrets and web-player/.env.

up.ps1 follows the new compose files, gains -Apps and -Tools for the two
profiles, generates the keys before starting rather than after, and no longer
swallows a provisioning failure as a warning.

deploy/scripts/common.ps1

@@ -1,11 +1,11 @@
 #requires -Version 5.1
-# Shared helpers for the deploy scripts.
+# Shared helpers for the development deploy scripts.
 
 function Write-Step([string]$Message) { Write-Host "`n==> $Message" -ForegroundColor Cyan }
 
-# Parses a .env file into a hashtable (ignores comments and blank lines).
+# Parses a .env file into an ordered hashtable (ignores comments and blank lines).
 function Read-DotEnv([string]$Path) {
-    $values = @{}
+    $values = [ordered]@{}
     if (Test-Path $Path) {
         Get-Content $Path | ForEach-Object {
             if ($_ -match '^\s*([^#=\s][^=]*)=(.*)$') { $values[$matches[1].Trim()] = $matches[2].Trim() }
@@ -13,3 +13,14 @@ function Read-DotEnv([string]$Path) {
     }
     return $values
 }
+
+# Sets (or appends) a key in a .env file, preserving the rest of the file.
+function Set-DotEnvValue([string]$Path, [string]$Key, [string]$Value) {
+    $lines = @(Get-Content $Path)
+    if ($lines -match "^\s*$Key=") {
+        $lines = $lines -replace "^\s*$Key=.*", "$Key=$Value"
+    } else {
+        $lines += "$Key=$Value"
+    }
+    Set-Content -Path $Path -Value $lines -Encoding utf8
+}