GHSA-qff7-q5fm-8p76: AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration

The GET /api/station/{station_id}/file/{id}/play endpoint, handled by PlayAction, is missing the Middleware\Permissions check that protects all sibling routes in the same /file/{id} route group. Any authenticated user can download media files from any station, regardless of whether they have permissions on that station. In multi-tenant deployments, this enables cross-station media exfiltration.