fix: 6 Claude-Audit-Fixes (3 CRIT + 3 HIGH)

CRITICAL:
- Logout: LoginScreen statt MeloHome pushen (home_screen.dart)
- Path Traversal: sanitizeDateiname() zentral + sync-loop abgesichert
- SecureStorage: flutter_secure_storage für Token+Passwort (auth_service, navidrome)

HIGH:
- Seek: PlayerService.seek() reload-frei (audio_handler)
- Play/Pause: Zielzustand statt Toggle für System-Controls
- X-User: Header entfernt, Server verlässt sich auf JWT

lib/services/cloud_service.dart

@@ -11,11 +11,9 @@ class CloudService {
   static final http.Client _client = http.Client();
 
   static String get _base => AppConfig.cloudUrl;
-  String _user = '';
 
   /// Login mit Baka-Auth – Token wird aus AuthService bezogen
   Future<bool> login(String user) async {
-    _user = user;
     try {
       final r = await _client
           .get(Uri.parse('$_base/api/cloud/status'),
@@ -32,9 +30,6 @@ class CloudService {
     final headers = <String, String>{
       'X-API-Key': AppConfig.ytProxyApiKey,
     };
-    if (_user.isNotEmpty) {
-      headers['X-User'] = _user;
-    }
     if (token != null && token.isNotEmpty) {
       headers['Authorization'] = 'Bearer $token';
     }