fix: auto-scan cloud libraries on boot + allow CORS for media playback

- Add BootCloudLibraries() to auto-scan all cloud libraries on startup
- Delay 3s to avoid conflict with system init, scan without auto-scrape
- Enable CORS for /api/cloud/play/* and /api/img to support 3rd-party players
- Fixes issue where each user triggers separate cloud library scans
- Fixes issue where Infuse/Emby apps cannot play cloud resources

internal/service/qbittorrent.go

@@ -16,7 +16,7 @@ package service
 import (
 	"bytes"
 	"context"
-	"crypto/sha1"
+	"crypto/sha1" // #nosec G505 -- BitTorrent v1 info-hash is SHA-1 by protocol.
 	"encoding/hex"
 	"encoding/json"
 	"errors"
@@ -335,7 +335,7 @@ func torrentInfoHash(data []byte) string {
 	if !ok {
 		return ""
 	}
-	sum := sha1.Sum(data[start:end])
+	sum := sha1.Sum(data[start:end]) // #nosec G401 -- BitTorrent v1 info-hash is SHA-1 by protocol, not a security hash.
 	return hex.EncodeToString(sum[:])
 }