Replace the legacy Flatpak repo key with Bearwave App
<dev@bearwave.app> (5BAA384577671E45) in bearwave.flatpakref,
build-flatpak.sh, and deploy-flatpak.sh.
Explain why 1.0.4 is a git tag while 1.0.5 is the verified GitHub release.
Trigger AUR publish on releases and via workflow_dispatch; bump PKGBUILD base.
Validate manual stream URLs (http/https only), restrict notification
cover downloads to HTTPS, and add transfer timeouts for metadata and
cover fetches. Document playback, tray, MPRIS, and QML refactor changes
in CHANGELOG and AppStream metadata.