fix: auto-scan cloud libraries on boot + allow CORS for media playback

- Add BootCloudLibraries() to auto-scan all cloud libraries on startup
- Delay 3s to avoid conflict with system init, scan without auto-scrape
- Enable CORS for /api/cloud/play/* and /api/img to support 3rd-party players
- Fixes issue where each user triggers separate cloud library scans
- Fixes issue where Infuse/Emby apps cannot play cloud resources

internal/service/security_helpers.go

@@ -0,0 +1,44 @@
+package service
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"math/big"
+	"strconv"
+	"time"
+)
+
+func secureRandomBytes(buf []byte) {
+	if len(buf) == 0 {
+		return
+	}
+	if _, err := rand.Read(buf); err == nil {
+		return
+	}
+	seed := sha256.Sum256([]byte(time.Now().Format(time.RFC3339Nano)))
+	for offset := 0; offset < len(buf); {
+		offset += copy(buf[offset:], seed[:])
+		seed = sha256.Sum256(seed[:])
+	}
+}
+
+func secureRandomIntn(max int) int {
+	if max <= 0 {
+		return 0
+	}
+	n, err := rand.Int(rand.Reader, big.NewInt(int64(max)))
+	if err == nil {
+		value, convErr := strconv.Atoi(n.String())
+		if convErr == nil {
+			return value
+		}
+	}
+	seed := sha256.Sum256([]byte(time.Now().Format(time.RFC3339Nano)))
+	value := new(big.Int).SetBytes(seed[:])
+	value.Mod(value, big.NewInt(int64(max)))
+	fallback, convErr := strconv.Atoi(value.String())
+	if convErr != nil {
+		return 0
+	}
+	return fallback
+}