Harden codebase: fix path traversal, add Subsonic error checking, crypto-random auth salt, section-aware config save, ffmpeg process leak, and 14 other bug/security fixes

resolve/m3u.go

@@ -24,6 +24,7 @@ type m3uEntry struct {
 // entries without EXTINF lines.
 func parseM3U(r io.Reader, baseDir string) ([]m3uEntry, error) {
 	scanner := bufio.NewScanner(r)
+	scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024) // 1 MB max line — handles large EXTINF metadata
 	var entries []m3uEntry
 	var pending *m3uEntry // EXTINF parsed, waiting for path line
 

resolve/pls.go

@@ -125,7 +125,7 @@ func allStreams(entries []plsEntry) bool {
 			return false
 		}
 	}
-	return len(entries) > 1
+	return len(entries) >= 1
 }
 
 // stripMirrorSuffix removes a trailing " (#N)" or " #N" suffix that radio