Security-Fixes aus dem flutter-security Audit

CRIT:
- Cloud-Token jetzt in flutter_secure_storage (Keystore/Keychain) statt SharedPreferences, mit Migration alter Eintraege
- usesCleartextTraffic entfernt (kein HTTP-Klartext mehr)
HIGH:
- Path-Traversal gefixt: p.basename bei YouTube-Download, Navidrome-Download und Cloud-Auto-Sync
MED:
- allowBackup=false (kein Backup von Token-Daten)
- Navidrome-Salt kryptographisch sicher (Random.secure statt Timestamp)

lib/viewmodels/melo_home_viewmodel.dart

@@ -1,5 +1,6 @@
 import 'dart:async';
 import 'package:flutter/foundation.dart';
+import 'package:path/path.dart' as p;
 import '../database/db_helper.dart';
 import '../services/player_service.dart';
 import '../services/musik_scanner.dart';
@@ -309,7 +310,7 @@ class MeloHomeViewModel extends ChangeNotifier {
             .map((f) => f.path.split('/').last).toSet();
 
         for (final s in serverSongs) {
-          final title = s['title'].toString();
+          final title = p.basename(s['title'].toString());
           if (localFiles.contains(title)) continue; // schon lokal
           await cloud.download(s['id'].toString(), '${dir.path}/$title');
         }