feat(lyrics): YouLyPlus karaoke + fix(macos): suppress mic prompt

Two independent user-facing fixes rolled together.

── Lyrics: YouLyPlus provider (issue #172) ──
Adds word-by-word synced (karaoke) lyrics as an alternative lyrics mode.
Backed by the public lyricsplus aggregator (Apple Music / Spotify /
Musixmatch / QQ Music) — no API keys on our side, subscription costs are
borne by the backend operator. Five mirrors are tried on network failure.

Settings → Lyrics now exposes a mode radio (Standard vs YouLyPlus) plus
a static-only toggle. YouLyPlus misses silently fall back to the existing
server + LRCLIB + Netease pipeline so obscure tracks still resolve. The
drag-to-reorder source list is hidden in YouLyPlus mode since the
external aggregator manages its own source priority.

Rendering: per-word spans on each line, active word highlighted with
accent-tinted glow. Subscribed imperatively via usePlayerStore.subscribe
so 500 ms progress ticks do not re-render the whole lyrics block. The
Fullscreen Player reuses the same pattern; the 5-line rail layout is
unchanged. white-space: pre on .fs-lyric-word preserves the trailing
spaces the API embeds in each syllabus token (flex context would
otherwise collapse them).

i18n: new keys in all 8 locales (de, en, fr, nl, nb, ru, es, zh).

── macOS mic-prompt suppression ──
Ships a vendored cpal 0.15.3 at patches/cpal-0.15.3/ wired via
[patch.crates-io]. The only change is in src/host/coreaudio/macos/mod.rs:
audio_unit_from_device now unconditionally uses IOType::DefaultOutput for
output streams instead of conditionally choosing HalOutput.

AUHAL (HalOutput) is classified as input-capable by macOS TCC and
triggers the microphone-permission dialog at first launch / after each
update even for playback-only apps. Previous attempts (removing
NSMicrophoneUsageDescription, setting com.apple.security.device.audio-input
false in Entitlements.plist) did not suppress the prompt because TCC
fires at AudioUnit instantiation, not at plist level. The upstream fix
in cpal PR #1070 / cpal 0.17 only helps when the pinned device equals
the system default; always-DefaultOutput covers all cases.

Tradeoff: per-device output selection is a no-op on macOS — the stream
always follows the system default. Settings.tsx surfaces this via
audioOutputDeviceMacNotice (hides the CustomSelect on macOS) and skips
audio_list_devices + device-watcher effects there. Matches the behaviour
of Apple Music / Spotify on macOS.

Also removes the now-obsolete com.apple.security.device.audio-input
entitlement (sandbox is disabled anyway, so it was ignored).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/locales/zh.ts

@@ -519,6 +519,7 @@ export const zhTranslation = {
     audioOutputDeviceOsDefaultNow: '当前系统输出',
     audioOutputDeviceListError: '无法加载音频设备列表。',
     audioOutputDeviceNotInCurrentList: '不在当前列表中',
+    audioOutputDeviceMacNotice: '在 macOS 上，出于技术原因，目前播放始终跟随系统输出设备。请通过 系统设置 → 声音 或菜单栏扬声器图标切换目标设备。背景：打开非默认音频流时 CoreAudio 会触发麦克风权限提示 —— 我们通过始终使用系统默认输出来避免此提示。',
     hiResTitle: '原生高清晰度播放',
     hiResEnabled: '启用原生高清晰度播放',
     hiResDesc: "默认强制 44.1 kHz 输出以获得最大稳定性。仅在硬件和网络可靠支持高采样率（88.2 kHz+）时启用。",
@@ -548,6 +549,12 @@ export const zhTranslation = {
     lyricsSourceServer: '服务器',
     lyricsSourceLrclib: 'LRCLIB',
     lyricsSourceNetease: '网易云音乐',
+    lyricsModeStandard: '标准',
+    lyricsModeStandardDesc: '三个可自由排序的来源：服务器标签、LRCLIB、网易云。',
+    lyricsModeLyricsplus: 'YouLyPlus（卡拉OK）',
+    lyricsModeLyricsplusDesc: '来自 Apple Music、Spotify、Musixmatch 和 QQ 音乐的逐字同步歌词（社区后端）。找不到时静默回退到标准来源。',
+    lyricsStaticOnly: '仅以静态文本显示歌词',
+    lyricsStaticOnlyDesc: '同步歌词将不自动滚动、不逐字高亮，以静态文本显示。',
     downloadsTitle: 'ZIP 导出与归档',
     downloadsFolderDesc: '将专辑以 ZIP 文件下载到电脑时的目标文件夹。',
     downloadsDefault: '默认下载文件夹',
@@ -928,6 +935,7 @@ export const zhTranslation = {
     lyricsSourceServer: '来源：服务器',
     lyricsSourceLrclib: '来源：LRCLIB',
     lyricsSourceNetease: '来源：网易云',
+    lyricsSourceLyricsplus: '来源：YouLyPlus',
   },
   songInfo: {
     title: '歌曲信息',