Security-Review-Fixes (Builder): Salt-Regression behoben + Defense-in-Depth

- Navidrome-Salt wieder kryptographisch sicher (Random.secure, 16 Bytes)
  - Regression: v2.31-Redesign (36c744d) hatte den Security-Audit-Fix
    aus 77a2042 stillschweigend auf Timestamp zurueckgesetzt
- Server-IDs (Navidrome s.id, Registry sid) vor Dateinamen defensiv sanitized
  (sanitizeDateiname) — kein Path-Traversal ueber Server-Werte
- MANAGE_EXTERNAL_STORAGE entfernt: deklariert aber nie angefragt
  (toter Berechtigungs-Surface, Play-Store-Policy-Risiko)
- Neuer Test: navidrome_salt_test.dart (Salt != Timestamp, 16 Bytes, eindeutig)

Verifiziert: flutter analyze 0 Issues, flutter test 156/156

lib/screens/download_screen.dart

@@ -8,6 +8,7 @@ import '../services/cloud_service.dart';
 import '../models/song.dart';
 import '../database/db_helper.dart';
 import '../utils/farb_theme.dart';
+import '../utils/sanitize.dart';
 import '../services/melo_logger.dart';
 import '../config/app_config.dart';
 import '../widgets/melo_loader.dart';
@@ -61,7 +62,8 @@ class _DownloadScreenState extends State<DownloadScreen> with WidgetsBindingObse
     try {
       final dir = Directory('${(await getApplicationDocumentsDirectory()).path}/music');
       if (!await dir.exists()) await dir.create(recursive: true);
-      final dest = '${dir.path}/cloud_$sid.mp3';
+      // Server-ID defensiv sanitizen — kein Path-Traversal über sid
+      final dest = '${dir.path}/cloud_${sanitizeDateiname(sid)}.mp3';
       final ok = await _cloud.download(sid, dest);
       if (ok && mounted) {
         final song = Song(