Security: Cloud-Auth auf Bearer-JWT umgestellt (IDOR-Luecke geschlossen)

- cloud_service: echter Login gegen baka-auth, Token statt X-API-Key/X-User
- app_config: hartcodierten API-Key-Default entfernt
- download_service + melo_logger: Bearer-Token statt X-API-Key
- navidrome: Passwort in flutter_secure_storage (Keychain/Keystore)
- song: token-haltige stream_url wird nicht mehr in SQLite persistiert
- cloud_screen: Pfad-Traversal beim Download-Dateinamen gefixt (p.basename)
- home_screen: Login-Dialog mit Passwort-Feld, Auto-Sync nutzt restoreLogin

lib/screens/download_screen.dart

@@ -1,9 +1,12 @@
 import 'package:flutter/material.dart';
 import 'package:path_provider/path_provider.dart';
 import 'package:shared_preferences/shared_preferences.dart';
+import 'package:just_audio/just_audio.dart';
 import '../services/download_service.dart';
+import '../services/cloud_service.dart';
 import '../utils/farb_theme.dart';
 import '../services/melo_logger.dart';
+import '../widgets/melo_loader.dart';
 
 class DownloadScreen extends StatefulWidget {
   final DownloadService downloader;
@@ -19,18 +22,76 @@ class DownloadScreen extends StatefulWidget {
   State<DownloadScreen> createState() => _DownloadScreenState();
 }
 
-class _DownloadScreenState extends State<DownloadScreen> {
+class _DownloadScreenState extends State<DownloadScreen> with WidgetsBindingObserver {
   final _urlController = TextEditingController();
+  final _cloud = CloudService();
+  final _previewPlayer = AudioPlayer();
   bool _ladt = false;
+  List<Map<String, dynamic>> _globalSongs = [];
+  String? _previewSid;
   String? _fehler;
   String? _erfolg;
-  String _speicherOrt = 'App-intern';
+  String _speicherOrt = 'App-intern (Music/)';
+
+  @override
+  void dispose() {
+    WidgetsBinding.instance.removeObserver(this);
+    _previewPlayer.dispose();
+    super.dispose();
+  }
+
+  @override
+  void didChangeAppLifecycleState(AppLifecycleState state) {
+    if (state == AppLifecycleState.paused || state == AppLifecycleState.inactive) {
+      _stopPreview();
+    }
+  }
+
+  Future<void> _ladeGlobalListe() async {
+    final songs = await _cloud.globalList();
+    if (mounted) setState(() => _globalSongs = songs.cast<Map<String, dynamic>>());
+  }
+
+  Future<void> _addFromRegistry(String sid) async {
+    final ok = await _cloud.download(sid, '/tmp/melo_reg_$sid.mp3');
+    if (ok && mounted) {
+      setState(() => _erfolg = 'Song hinzugefügt!');
+      widget.onSongsChanged();
+      await _ladeGlobalListe();
+    }
+  }
+
+  Future<void> _startPreview(String sid) async {
+    if (_previewSid == sid && _previewPlayer.playing) {
+      await _stopPreview();
+      return;
+    }
+    _previewSid = sid;
+    try {
+      final url = 'http://159.195.51.99:8993/api/cloud/stream/$sid';
+      await _previewPlayer.setUrl(url);
+      await _previewPlayer.seek(const Duration(seconds: 11));
+      await _previewPlayer.play();
+      Future.delayed(const Duration(seconds: 10), () {
+        if (_previewSid == sid) _stopPreview();
+      });
+    } catch (e) {
+      MeloLogger().fehler('preview', e);
+    }
+  }
+
+  Future<void> _stopPreview() async {
+    _previewSid = null;
+    await _previewPlayer.stop();
+  }
   bool _speichertInDownloads = false;
 
   @override
   void initState() {
     super.initState();
+    WidgetsBinding.instance.addObserver(this);
     _ladeSpeicherPfad();
+    _ladeGlobalListe();
   }
 
   Future<void> _ladeSpeicherPfad() async {
@@ -63,6 +124,9 @@ class _DownloadScreenState extends State<DownloadScreen> {
             const Divider(color: MeloTheme.dunkel2),
             _optionTile(ctx, '⬇ Downloads/Melo', 'downloads',
                 icon: Icons.download),
+            const Divider(color: MeloTheme.dunkel2),
+            _optionTile(ctx, '💾 SD-Karte / Extern', 'extern',
+                icon: Icons.sd_storage),
           ],
         ),
       ),
@@ -82,6 +146,19 @@ class _DownloadScreenState extends State<DownloadScreen> {
           _speicherOrt = '⬇ Downloads/Melo';
         });
       }
+    } else if (auswahl == 'extern') {
+      final dirs = await getExternalStorageDirectories();
+      if (dirs != null && dirs.isNotEmpty) {
+        final pfad = '${dirs.first.path}/Melo';
+        await prefs.setBool('download_in_downloads', false);
+        widget.downloader.setzeSpeicherPfad(pfad);
+        setState(() {
+          _speichertInDownloads = false;
+          _speicherOrt = '💾 ${dirs.first.path.split('/').last}/Melo';
+        });
+      } else {
+        if (mounted) setState(() => _fehler = 'Kein externer Speicher gefunden');
+      }
     } else {
       await prefs.setBool('download_in_downloads', false);
       widget.downloader.setzeSpeicherPfad('');
@@ -139,7 +216,7 @@ class _DownloadScreenState extends State<DownloadScreen> {
         title: const Row(children: [
           Icon(Icons.download, color: MeloTheme.rot, size: 20),
           SizedBox(width: 8),
-          Text('Downloads', style: TextStyle(color: Colors.white, fontSize: 18)),
+          Text('Lied +', style: TextStyle(color: Colors.white, fontSize: 18)),
         ]),
         actions: [
           if (_erfolg != null || _fehler != null)
@@ -153,6 +230,67 @@ class _DownloadScreenState extends State<DownloadScreen> {
         padding: const EdgeInsets.all(20),
         child: Column(
           children: [
+            // ─── Globale Registry (Lied +) ───
+            if (_globalSongs.isNotEmpty) ...[
+              Row(children: [
+                const Icon(Icons.public, color: MeloTheme.rot, size: 16),
+                const SizedBox(width: 6),
+                Text('Globale Songs (${_globalSongs.length})',
+                    style: const TextStyle(color: Colors.white70, fontSize: 13, fontWeight: FontWeight.w600)),
+                const Spacer(),
+                GestureDetector(
+                  onTap: _ladeGlobalListe,
+                  child: const Icon(Icons.refresh, color: Colors.grey, size: 16),
+                ),
+              ]),
+              const SizedBox(height: 8),
+              SizedBox(
+                height: 100,
+                child: ListView.builder(
+                  scrollDirection: Axis.horizontal,
+                  itemCount: _globalSongs.length,
+                  itemBuilder: (_, i) {
+                    final s = _globalSongs[i];
+                    final sid = s['id']?.toString() ?? '';
+                    final title = s['title']?.toString() ?? '?';
+                    final isPreviewing = _previewSid == sid;
+                    return Container(
+                      width: 140,
+                      margin: const EdgeInsets.only(right: 8),
+                      decoration: BoxDecoration(
+                        color: isPreviewing ? const Color(0xFF2A0000) : MeloTheme.dunkel1,
+                        borderRadius: BorderRadius.circular(10),
+                        border: Border.all(color: isPreviewing ? MeloTheme.rot : MeloTheme.dunkel2),
+                      ),
+                      child: Column(
+                        mainAxisAlignment: MainAxisAlignment.center,
+                        children: [
+                          Text(title, style: TextStyle(fontSize: 11, color: Colors.white, fontWeight: FontWeight.w500),
+                              maxLines: 2, overflow: TextOverflow.ellipsis, textAlign: TextAlign.center),
+                          const SizedBox(height: 4),
+                          Row(
+                            mainAxisAlignment: MainAxisAlignment.center,
+                            children: [
+                              GestureDetector(
+                                onTap: () => _startPreview(sid),
+                                child: Icon(isPreviewing ? Icons.stop : Icons.play_arrow,
+                                    color: isPreviewing ? Colors.white : MeloTheme.rot, size: 20),
+                              ),
+                              const SizedBox(width: 10),
+                              GestureDetector(
+                                onTap: () => _addFromRegistry(sid),
+                                child: const Icon(Icons.add_circle_outline, color: Colors.grey, size: 18),
+                              ),
+                            ],
+                          ),
+                        ],
+                      ),
+                    );
+                  },
+                ),
+              ),
+              const Divider(color: MeloTheme.dunkel2),
+            ],
             // ─── Zielordner ───
             GestureDetector(
               onTap: _ladt ? null : _ordnerDialog,
@@ -199,59 +337,59 @@ class _DownloadScreenState extends State<DownloadScreen> {
             ),
             const SizedBox(height: 12),
 
-            // ─── Download- & Abbruch-Button ───
-            Row(
-              children: [
-                Expanded(
-                  flex: _ladt ? 3 : 1,
-                  child: SizedBox(
-                    height: 48,
-                    child: ElevatedButton.icon(
-                      onPressed: _ladt ? null : _starteDownload,
-                      icon: _ladt
-                          ? const SizedBox(width: 20, height: 20,
-                              child: CircularProgressIndicator(strokeWidth: 2, color: Colors.white))
-                          : const Icon(Icons.download, size: 20),
-                      label: Text(_ladt ? 'Lade herunter...' : '⬇ Download'),
-                      style: ElevatedButton.styleFrom(
-                        backgroundColor: MeloTheme.rot,
-                        foregroundColor: Colors.white,
-                        shape: RoundedRectangleBorder(borderRadius: BorderRadius.circular(12)),
-                      ),
-                    ),
+            // ─── Animierte Ladeanzeige (während Download) ───
+            if (_ladt) ...[
+              MeloLoader(
+                titel: widget.downloader.aktuellerTitel ?? 'Lade herunter...',
+              ),
+              const SizedBox(height: 16),
+            ],
+
+            // ─── Download-Button ───
+            SizedBox(
+              width: double.infinity,
+              height: 48,
+              child: ElevatedButton.icon(
+                onPressed: _ladt ? null : _starteDownload,
+                icon: _ladt
+                    ? const SizedBox(width: 20, height: 20,
+                        child: CircularProgressIndicator(strokeWidth: 2, color: Colors.white))
+                    : const Icon(Icons.download, size: 20),
+                label: Text(_ladt ? 'Lädt...' : '⬇ Download'),
+                style: ElevatedButton.styleFrom(
+                  backgroundColor: MeloTheme.rot,
+                  foregroundColor: Colors.white,
+                  shape: RoundedRectangleBorder(borderRadius: BorderRadius.circular(12)),
+                ),
+              ),
+            ),
+            if (_ladt) ...[
+              const SizedBox(height: 8),
+              SizedBox(
+                width: double.infinity,
+                height: 40,
+                child: ElevatedButton.icon(
+                  onPressed: _abbrechen,
+                  icon: const Icon(Icons.cancel, size: 18),
+                  label: const Text('Abbrechen'),
+                  style: ElevatedButton.styleFrom(
+                    backgroundColor: Colors.red.shade800,
+                    foregroundColor: Colors.white,
+                    shape: RoundedRectangleBorder(borderRadius: BorderRadius.circular(12)),
                   ),
                 ),
-                if (_ladt) ...[
-                  const SizedBox(width: 8),
-                  Expanded(
-                    flex: 1,
-                    child: SizedBox(
-                      height: 48,
-                      child: ElevatedButton.icon(
-                        onPressed: _abbrechen,
-                        icon: const Icon(Icons.cancel, size: 20),
-                        label: const Text('Stop'),
-                        style: ElevatedButton.styleFrom(
-                          backgroundColor: Colors.red.shade800,
-                          foregroundColor: Colors.white,
-                          shape: RoundedRectangleBorder(borderRadius: BorderRadius.circular(12)),
-                        ),
-                      ),
-                    ),
-                  ),
-                ],
-              ],
-            ),
+              ),
+            ],
             const SizedBox(height: 16),
 
-            // ─── Live-Status via ListenableBuilder ───
+            // ─── Fortschritt ───
             if (_ladt)
               ListenableBuilder(
                 listenable: widget.downloader,
                 builder: (context, _) {
-                  final status = widget.downloader.aktuellerTitel;
                   final fortschritt = widget.downloader.fortschritt;
 
+                  if (fortschritt <= 0) return const SizedBox.shrink();
                   return Container(
                     width: double.infinity,
                     padding: const EdgeInsets.all(12),
@@ -260,21 +398,13 @@ class _DownloadScreenState extends State<DownloadScreen> {
                       borderRadius: BorderRadius.circular(12),
                     ),
                     child: Column(children: [
-                      if (status != null) ...[
-                        Text(status,
-                            style: const TextStyle(color: Colors.white70, fontSize: 13),
-                            textAlign: TextAlign.center),
-                      ],
-                      if (fortschritt > 0) ...[
-                        const SizedBox(height: 8),
-                        LinearProgressIndicator(
-                            value: fortschritt,
-                            color: MeloTheme.rot,
-                            backgroundColor: MeloTheme.dunkel2),
-                        const SizedBox(height: 4),
-                        Text('${(fortschritt * 100).toStringAsFixed(0)}%',
-                            style: const TextStyle(color: Colors.grey, fontSize: 11)),
-                      ],
+                      LinearProgressIndicator(
+                          value: fortschritt,
+                          color: MeloTheme.rot,
+                          backgroundColor: MeloTheme.dunkel2),
+                      const SizedBox(height: 4),
+                      Text('${(fortschritt * 100).toStringAsFixed(0)}%',
+                          style: const TextStyle(color: Colors.grey, fontSize: 11)),
                     ]),
                   );
                 },