Implements track.scrobble and track.updateNowPlaying via the Last.fm
API entirely within ncmpcpp, with no external dependencies.

New files:
- src/scrobbler.h / src/scrobbler.cpp: self-contained scrobbler module
  with a public-domain MD5 implementation for API signature generation,
  desktop auth flow (auth.getToken + auth.getSession), and all HTTP
  calls dispatched in detached threads so the UI is never blocked.

Modified files:
- src/curl_handle: add Curl::post() for HTTP POST requests
- src/settings: add 'lastfm_scrobble' bool config option
- src/status.cpp: hook scrobbler into Changes::songID() (song change),
  Changes::playerState() (stop), and Changes::elapsedTime() (threshold
  tracking); call Scrobbler::initialize() from initialize_status()
- src/Makefile.am: add scrobbler.cpp to build
- doc/config: document the new lastfm_scrobble option

Auth flow: on first run with no cached session key, ncmpcpp prints an
authorization URL to stderr. The user opens it in a browser, clicks
Allow, and ncmpcpp polls auth.getSession until authorized (up to 90s).
The session key is then cached to ncmpcpp_directory/lastfm_session and
reused on all subsequent runs.

Scrobble rules follow the Last.fm spec: song must be >=30s long and
>=50% played or >=4 minutes elapsed before a scrobble is submitted.

Note: LASTFM_API_KEY and LASTFM_API_SECRET in src/scrobbler.cpp must
be set to your own registered API credentials before building.

initialize_status() is called again on MPD reconnect, which was
causing authenticate() to fire twice and print two authorization
URLs. A static bool ensures initialize() is a no-op on any call
after the first.

ensureAuthenticated() was calling authenticate() from scrobble/
now-playing background threads, racing with the main thread's
initialize() and producing a second interactive auth prompt.

Auth now only happens in initialize() at startup. Background threads
simply return false if no session key is available yet.