feat: add restrict:staging script

[cdtinney]

Summary

Wraps the two-step "set ALLOWED_SPOTIFY_IDS and restart staging-app" workflow as a single laptop-side command. SSHes into the droplet, edits /opt/spune-staging/.env (replacing the existing line if present, otherwise appending), and runs docker compose restart staging-app.

pnpm restrict:staging                    # ALLOWED_SPOTIFY_IDS=cdtinney
pnpm restrict:staging alice,bob,cdtinney # custom list
SPUNE_HOST=root@1.2.3.4 pnpm restrict:staging

Pairs with #211 (which adds the env var the server actually reads). This PR is independent of #211 — it only writes to a file and runs a container restart, both of which work regardless of whether the running staging image understands ALLOWED_SPOTIFY_IDS yet.

Defaults: IDS=cdtinney, HOST=root@spune.tinney.dev. Validates that input is alphanumeric + ,_- only to keep the value safe to interpolate into .env and sed.

Testing

• bash -n scripts/restrict-staging.sh (syntax-check) clean
• Format check clean
• Local dry run with a non-existent host returns the expected SSH error
• After both this and feat: add ALLOWED_SPOTIFY_IDS login allowlist #211 land, run pnpm restrict:staging and confirm a non-allowlisted Spotify account is rejected at staging login (callback redirects to login page, no user row created)