Security-Fixes aus dem flutter-security Audit

CRIT:
- Cloud-Token jetzt in flutter_secure_storage (Keystore/Keychain) statt SharedPreferences, mit Migration alter Eintraege
- usesCleartextTraffic entfernt (kein HTTP-Klartext mehr)
HIGH:
- Path-Traversal gefixt: p.basename bei YouTube-Download, Navidrome-Download und Cloud-Auto-Sync
MED:
- allowBackup=false (kein Backup von Token-Daten)
- Navidrome-Salt kryptographisch sicher (Random.secure statt Timestamp)

lib/services/download_service.dart

@@ -3,6 +3,7 @@ import 'dart:convert';
 import 'dart:io';
 import 'package:flutter/foundation.dart';
 import 'package:http/http.dart' as http;
+import 'package:path/path.dart' as p;
 import 'package:path_provider/path_provider.dart';
 import '../models/song.dart';
 import '../database/db_helper.dart';
@@ -249,8 +250,8 @@ class DownloadService extends ChangeNotifier {
           : Directory('${(await getApplicationDocumentsDirectory()).path}/music');
       if (!await dir.exists()) await dir.create(recursive: true);
 
-      // Sicheren Dateinamen erstellen
-      final safeName = titel.replaceAll(RegExp(r'[^\w\s-]'), '').trim();
+      // Sicheren Dateinamen erstellen (p.basename verhindert Path-Traversal)
+      final safeName = p.basename(titel).replaceAll(RegExp(r'[^\w\s-]'), '').trim();
       final lokalerName = '${safeName.isEmpty ? "song" : safeName}.mp3';
       dateiPfad = '${dir.path}/$lokalerName';