fix: 6 Claude-Audit-Fixes (3 CRIT + 3 HIGH)

CRITICAL:
- Logout: LoginScreen statt MeloHome pushen (home_screen.dart)
- Path Traversal: sanitizeDateiname() zentral + sync-loop abgesichert
- SecureStorage: flutter_secure_storage für Token+Passwort (auth_service, navidrome)

HIGH:
- Seek: PlayerService.seek() reload-frei (audio_handler)
- Play/Pause: Zielzustand statt Toggle für System-Controls
- X-User: Header entfernt, Server verlässt sich auf JWT

lib/screens/cloud_screen.dart

@@ -5,6 +5,7 @@ import 'package:path_provider/path_provider.dart';
 import 'package:shared_preferences/shared_preferences.dart';
 import 'package:flutter_local_notifications/flutter_local_notifications.dart';
 import '../utils/farb_theme.dart';
+import '../utils/sanitize.dart';
 import '../services/cloud_service.dart';
 import '../services/auth_service.dart';
 import '../database/db_helper.dart';
@@ -216,7 +217,8 @@ class _CloudScreenState extends State<CloudScreen> {
 
         _updateSync('Download: $title...',
             0.1 + (0.4 * processed / (totalNew > 0 ? totalNew : 1)));
-        final dest = '${dir.path}/$title';
+        final safeTitle = sanitizeDateiname(title);
+        final dest = '${dir.path}/$safeTitle';
         if (await widget.cloud.download(sid, dest)) {
           downloaded++;
           // In DB eintragen mit cloud_id