Make Flatpak updates unmistakable after clients were stuck on the
May 1.0.3 commit. Expose bearwaveVersion/bearwaveBuildId to QML and
set the flatpak manifest version explicitly.
Validate manual stream URLs (http/https only), restrict notification
cover downloads to HTTPS, and add transfer timeouts for metadata and
cover fetches. Document playback, tray, MPRIS, and QML refactor changes
in CHANGELOG and AppStream metadata.
