feat(qbzd): LAN CORS, headless MPRIS, security model

LAN-only CORS: allows any origin on local network for qbz-control PWA.

MPRIS via souvlaki (D-Bus, no window): play/pause/toggle/next/prev/stop
media keys work out of the box on any Linux desktop or headless system
with D-Bus. Metadata and playback state updates available via helpers.

Security model finalized:
- LAN: open access, no auth needed (private IP check)
- WAN: completely blocked (403 for non-private IPs)
- Remote: QConnect only (cloud, Qobuz-managed auth)

cc

crates/qbzd/Cargo.toml

@@ -57,3 +57,6 @@ rusqlite = { version = "0.31", features = ["bundled"] }
 
 # Credentials (shared keyring with desktop app)
 keyring = { version = "3", features = ["async-secret-service", "crypto-rust"] }
+
+# MPRIS media controls (Linux D-Bus, headless)
+souvlaki = "0.8"