Use /api/v1 with token authentication and typed responses

Closes #38, #39 and #40; adds the client side of #41.

- Every request goes to /api/v1. MusicServerClient gets a token with
  Settings.api_password the first time one is needed, reuses it, and on a
  401 gets a new one and sends the request once more. Switching server gets
  a new token too. Callers never see the token.
- Sync is started with POST, as MusicServer 5.0 requires.
- The client has every endpoint in the server's OpenAPI spec, including
  statistics, soundtracks and songs by UUID, version, downloads and tokens.
- tools/generate_api_types.gd generates a typed class per schema in
  server/openapi.json into server/generated/. Song info, statistics and
  versions are passed to callers as these classes. A list the server sends
  as null is an empty list.
- FakeHttpTransport hands out tokens and answers 401 without one, so every
  test goes through the token flow. New tests cover the token handling,
  every endpoint and each generated class.

data/settings.gd

@@ -6,6 +6,9 @@ extends Node
 const MAX_NUMBER_OF_PLAYERS: int = 7
 
 var default_path: String = "https://music.sanplex.xyz"
+## Password for getting an API token from the server. Any password works when the
+## server has none set.
+var api_password: String = ""
 var selected_server: int = 0
 var is_local: bool = false
 var is_debug: bool = false