fix: auto-scan cloud libraries on boot + allow CORS for media playback

- Add BootCloudLibraries() to auto-scan all cloud libraries on startup
- Delay 3s to avoid conflict with system init, scan without auto-scrape
- Enable CORS for /api/cloud/play/* and /api/img to support 3rd-party players
- Fixes issue where each user triggers separate cloud library scans
- Fixes issue where Infuse/Emby apps cannot play cloud resources

internal/service/bot_features.go

@@ -2,7 +2,6 @@ package service
 
 import (
 	"context"
-	"crypto/rand"
 	"fmt"
 	"strconv"
 	"strings"
@@ -238,13 +237,7 @@ const codeAlphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789" // no ambiguous 0/O/1/I
 
 func randomCode(n int) string {
 	b := make([]byte, n)
-	if _, err := rand.Read(b); err != nil {
-		// crypto/rand failure is extremely unlikely; fall back to time noise.
-		seed := time.Now().UnixNano()
-		for i := range b {
-			b[i] = byte(seed >> (uint(i%8) * 8))
-		}
-	}
+	secureRandomBytes(b)
 	out := make([]byte, n)
 	for i := range b {
 		out[i] = codeAlphabet[int(b[i])%len(codeAlphabet)]