feat(streaming): CMAF segmented download pipeline

Download tracks via Qobuz Akamai CDN with encrypted CMAF segments.
Derives session key (HKDF), unwraps content key (AES-CBC), decrypts
frames (AES-CTR), reassembles into standard FLAC. Falls back to legacy
track/getFileUrl if CMAF fails.

- Add qbz-cmaf dependency to src-tauri
- Make ensure_cmaf_session public on QobuzClient
- Add ensure_cmaf_session and get_file_url passthroughs to CoreBridge
- Add download_audio_cmaf and try_cmaf_download helpers
- Wire CMAF as primary download path in v2_play_track with legacy fallback

cc

crates/qbz-qobuz/src/client.rs

@@ -1857,7 +1857,7 @@ impl QobuzClient {
 
     /// Ensure we have a valid CMAF session, renewing if expired.
     /// Returns `(session_id, infos)` for use with file/url and key derivation.
-    async fn ensure_cmaf_session(&self) -> Result<(String, String)> {
+    pub async fn ensure_cmaf_session(&self) -> Result<(String, String)> {
         let now = get_timestamp();
 
         // Check existing session (with 60s safety margin)