Authenticate with Spotify using OAuth PKCE and create a playlist

Steps

1. Generate a cryptographically random code_verifier string (43-128 characters), then compute code_challenge as the base64url-encoded SHA-256 hash of the verifier.
2. Redirect the user to https://accounts.spotify.com/authorize with response_type=code, client_id, redirect_uri, scope (at minimum playlist-modify-public or playlist-modify-private), code_challenge, and code_challenge_method=S256.
3. After the user authorizes, exchange the returned code for tokens via POST https://accounts.spotify.com/api/token with grant_type=authorization_code, code, redirect_uri, client_id, and code_verifier (no client secret needed for PKCE).
4. Create a playlist by POSTing to https://api.spotify.com/v1/users/{user_id}/playlists with Authorization: Bearer {access_token}, Content-Type: application/json, and a body containing name, public (boolean), and description.
5. Add tracks to the playlist by POSTing to https://api.spotify.com/v1/playlists/{playlist_id}/tracks with a JSON body containing an array of Spotify URIs (e.g., spotify:track:{id}).
6. Refresh the access token before it expires (typically 1 hour) using the refresh_token via POST to the token endpoint with grant_type=refresh_token.