fix: auto-scan cloud libraries on boot + allow CORS for media playback

- Add BootCloudLibraries() to auto-scan all cloud libraries on startup
- Delay 3s to avoid conflict with system init, scan without auto-scrape
- Enable CORS for /api/cloud/play/* and /api/img to support 3rd-party players
- Fixes issue where each user triggers separate cloud library scans
- Fixes issue where Infuse/Emby apps cannot play cloud resources

internal/service/subtitle.go

@@ -6,10 +6,10 @@
 //
 // External-subtitle discovery rules (matching MediaStation Python defaults):
 //
-//   1. Same directory, same basename, different extension.
-//   2. Same directory, ".sub/" or "subs/" subdirectory.
-//   3. Sibling languages e.g. movie.zh.srt / movie.en.srt → exposed as
-//      ?lang=zh / ?lang=en.
+//  1. Same directory, same basename, different extension.
+//  2. Same directory, ".sub/" or "subs/" subdirectory.
+//  3. Sibling languages e.g. movie.zh.srt / movie.en.srt → exposed as
+//     ?lang=zh / ?lang=en.
 //
 // Supported extensions: .srt, .ass, .ssa, .vtt.
 package service
@@ -139,11 +139,11 @@ func (s *SubtitleService) Serve(ctx context.Context, mediaID, sub string, w io.W
 		return err
 	}
 	mediaDir, _ := filepath.Abs(filepath.Dir(m.Path))
-	if !strings.HasPrefix(abs, mediaDir) {
+	if !pathWithin(abs, mediaDir) {
 		return fmt.Errorf("path escape")
 	}
 
-	f, err := os.Open(abs)
+	f, err := os.Open(abs) // #nosec G304 -- abs is constrained to the media file directory with pathWithin.
 	if err != nil {
 		return err
 	}