GHSA-qff7-q5fm-8p76

## Summary The `GET /api/station/{station_id}/file/{id}/play` endpoint, handled by `PlayAction`, is missing the `Middleware\Permissions` check that protects all sibling routes in the same `/file/{id}` route group. Any authenticated user can download media files from any station, regardless of whether they have permissions on that station. In multi-tenant deployments, this enables cross-station media exfiltration. ## Details In `backend/config/routes/api_station.php`, the `/file/{id}` route group (lines 407-429) defines four endpoints: ```php // Line 407-429 $group->group( '/file/{id}', function (RouteCollectorProxy $group) { // GET /file/{id} — has Permissions check ✓ $group->get('', ...)->add(new Middleware\Permissions(StationPermissions::Media, true)); // PUT /file/{id} — has Permissions check ✓ $group->put('', ...)->add(new Middleware\Permissions(StationPermissions::Media, true)); // DELETE /file/{id} — has Permissions check ✓ $group->delete('', ...)->add(new Middleware\Permissions(StationPermissions::DeleteMedia, true)); // GET /file/{id}/play — NO Permissions check ✗ $group->get('/play', Controller\Api\Stations\Files\PlayAction::class) ->setName('api:stations:files:play'); } ); ``` The middleware chain for the `/play` endpoint is: `GetStation → RequireStation → RequireLogin → StationSupportsFeature(Media) → PlayAction`. The `RequireLogin` middleware (`backend/src/Middleware/RequireLogin.php`) only verifies a valid session/API key exists — it does not check station-level permissions. The controller at `backend/src/Controller/Api/Stations/Files/PlayAction.php:84` calls `$this->mediaRepo->requireForStation($id, $station)`, which verifies the media belongs to the station but performs no authorization check. The `findForStation` method (`StationMediaRepository.php:46-66`) accepts both auto-increment integer IDs and unique IDs, making enumeration trivial via sequential in