fix(metadata): tag with correct song using known-good song_info

[CPbianma]

Summary

The download/decrypt paths previously called fetch_metadata(song_mid),
which round-trips QQ Music's search endpoint with the mid as the
keyword. When that mid isn't the top search hit, the endpoint silently
returns an unrelated song's metadata — so the file is either tagged
"metadata not found" or, worse, tagged with someone else's song info.

This PR threads the raw song dict from search_songs() through
write_metadata via a new song_info parameter, and has
write_metadata build meta via fetch_metadata_from_album_song()
before falling back to the legacy path. As a belt-and-braces guard,
fetch_metadata() now rejects results whose mid doesn't match the
requested one.

Reproducing the bug

QQ Music desktop running, logged in with VIP, then:

qmdec auth
qmdec download "周杰伦 晴天" -o ./out -q flac

Before this PR, the returned JSON contains
"tag": {"ok": false, "error": "metadata not found"} and the FLAC has
no title/artist/album/lyrics/cover.

After this PR every field fills in, matching what qmdec album
already produces.

Risk

• search_songs now carries the raw API dict in each returned item.
  Code that iterates result entries by their documented keys is
  unaffected.
• write_metadata signature is backwards-compatible (all new params
  are keyword-only with defaults).
• No new dependencies.

Test

Smoke-tested on Win11 / Python 3.14 against a live VIP account.
After the fix, qmdec download "周杰伦 晴天" -o ./out -q flac produces
tag.ok=true and FLAC inspection shows full title / artist / album /
year / track / disc / lyrics / 81 KB JPEG artwork.

---

中文说明

download / decrypt 路径之前调 fetch_metadata(song_mid) 是把 mid
当成关键词去走 QQ 音乐的搜索接口。如果这个 mid 不是搜索热门首条,
接口会静默返回另一首歌的元数据 —— 结果要么报 "metadata not found",
要么更糟, 把别人的元信息写进了你的文件。

本 PR 让 search_songs() 返回的原始 song dict 透传到 write_metadata
(新增 song_info 参数), 由 fetch_metadata_from_album_song() 直接构造
meta, 绕过有问题的搜索接口。同时 fetch_metadata() 加一道 mid 一致性
校验作为兜底。

复现

QQ 音乐桌面端登录 VIP 后:

qmdec auth
qmdec download "周杰伦 晴天" -o ./out -q flac

修复前 JSON 返回 "tag": {"ok": false, "error": "metadata not found"},
FLAC 没有任何标签。修复后所有字段齐全, 跟 qmdec album 表现一致。