Security-Review-Fixes (Builder): Salt-Regression behoben + Defense-in-Depth

- Navidrome-Salt wieder kryptographisch sicher (Random.secure, 16 Bytes)
  - Regression: v2.31-Redesign (36c744d) hatte den Security-Audit-Fix
    aus 77a2042 stillschweigend auf Timestamp zurueckgesetzt
- Server-IDs (Navidrome s.id, Registry sid) vor Dateinamen defensiv sanitized
  (sanitizeDateiname) — kein Path-Traversal ueber Server-Werte
- MANAGE_EXTERNAL_STORAGE entfernt: deklariert aber nie angefragt
  (toter Berechtigungs-Surface, Play-Store-Policy-Risiko)
- Neuer Test: navidrome_salt_test.dart (Salt != Timestamp, 16 Bytes, eindeutig)

Verifiziert: flutter analyze 0 Issues, flutter test 156/156

lib/screens/download_screen.dart

@@ -8,6 +8,7 @@ import '../services/cloud_service.dart';
 import '../models/song.dart';
 import '../database/db_helper.dart';
 import '../utils/farb_theme.dart';
+import '../utils/sanitize.dart';
 import '../services/melo_logger.dart';
 import '../config/app_config.dart';
 import '../widgets/melo_loader.dart';
@@ -61,7 +62,8 @@ class _DownloadScreenState extends State<DownloadScreen> with WidgetsBindingObse
     try {
       final dir = Directory('${(await getApplicationDocumentsDirectory()).path}/music');
       if (!await dir.exists()) await dir.create(recursive: true);
-      final dest = '${dir.path}/cloud_$sid.mp3';
+      // Server-ID defensiv sanitizen — kein Path-Traversal über sid
+      final dest = '${dir.path}/cloud_${sanitizeDateiname(sid)}.mp3';
       final ok = await _cloud.download(sid, dest);
       if (ok && mounted) {
         final song = Song(

lib/services/navidrome_service.dart

@@ -1,5 +1,6 @@
 import 'dart:convert';
 import 'dart:io';
+import 'dart:math';
 import 'package:flutter/foundation.dart';
 import 'package:crypto/crypto.dart';
 import 'package:http/http.dart' as http;
@@ -81,7 +82,10 @@ class NavidromeService {
     _serverUrl = url.endsWith('/') ? url.substring(0, url.length - 1) : url;
     _user = user;
     _password = password;
-    _salt = DateTime.now().millisecondsSinceEpoch.toString();
+    // Kryptographisch sicherer Salt (Random.secure statt vorhersagbarem
+    // Timestamp) — Security-Audit-Fix, war in v2.31-Redesign verloren gegangen.
+    final rng = Random.secure();
+    _salt = base64Encode(List.generate(16, (_) => rng.nextInt(256)));
     _token = md5.convert(utf8.encode(_password + _salt)).toString();
   }
 
@@ -133,6 +137,10 @@ class NavidromeService {
 
   bool get istVerbunden => _serverUrl.isNotEmpty && _user.isNotEmpty;
 
+  /// Nur für Tests: Salt einsehbar, um die Salt-Qualität zu prüfen.
+  @visibleForTesting
+  String get saltFuerTests => _salt;
+
   Uri _uri(String endpoint, [Map<String, String>? extra]) {
     final params = {
       'u': _user,
@@ -203,7 +211,9 @@ class NavidromeService {
       if (!await musikDir.exists()) await musikDir.create(recursive: true);
 
       final safeName = sanitizeDateiname(s.titel);
-      final kurzId = s.id.length > 8 ? s.id.substring(0, 8) : s.id;
+      // Server-ID defensiv sanitizen (kein Path-Traversal über s.id)
+      final safeId = sanitizeDateiname(s.id);
+      final kurzId = safeId.length > 8 ? safeId.substring(0, 8) : safeId;
       final dateiName = '${safeName}_$kurzId.mp3';
       final dateiPfad = '${musikDir.path}/$dateiName';