Use /api/v1 with token authentication and typed responses

Closes #38, #39 and #40; adds the client side of #41.

- Every request goes to /api/v1. MusicServerClient gets a token with
  Settings.api_password the first time one is needed, reuses it, and on a
  401 gets a new one and sends the request once more. Switching server gets
  a new token too. Callers never see the token.
- Sync is started with POST, as MusicServer 5.0 requires.
- The client has every endpoint in the server's OpenAPI spec, including
  statistics, soundtracks and songs by UUID, version, downloads and tokens.
- tools/generate_api_types.gd generates a typed class per schema in
  server/openapi.json into server/generated/. Song info, statistics and
  versions are passed to callers as these classes. A list the server sends
  as null is an empty list.
- FakeHttpTransport hands out tokens and answers 401 without one, so every
  test goes through the token flow. New tests cover the token handling,
  every endpoint and each generated class.

TESTING.md

@@ -48,7 +48,27 @@ assert_int(server.count("/music/rand")).is_equal(1)
 server.uninstall()
 ```
 
-Paths without a response get a 404, so the code under test sees a failed request.
+Paths are relative to the API (`/music/list` is `<server>/api/v1/music/list`). Paths
+without a response get a 404, so the code under test sees a failed request.
+
+Like the real server, the fake hands out tokens on `POST /token` and answers 401 to
+requests without a valid one, so the client's token handling runs in every test. Token
+requests are counted in `server.token_requests`, not in `requested_paths`. Use
+`server.expire_tokens()` to make the client renew its token, `server.hold("/token")` to
+keep it waiting for one, and `server.respond_json("/token", {...}, 401)` for a refused
+password.
+
+## API classes
+
+The classes in `server/generated/` (`SongInfo`, `StatisticsSummary`, ...) are generated
+from the server's OpenAPI spec, committed as `server/openapi.json`. To update them, copy
+a new spec there (`just openapi` in MusicServer, or `<server>/openapi.json`) and run:
+
+```bash
+godot --headless --path . -s tools/generate_api_types.gd
+```
+
+`tests/unit/test_api_types.gd` parses a sample response with each class.
 
 ## Writing tests