fix: BGM 混音链路修复——URL 先下载到本地缓存再混音

- fix: 删除 BGM 预览硬编码开发者路径，改为使用 url 字段
- fix: BGM 混音前检测是否为 URL，先下载到 bgm_cache 本地缓存
- fix: Rust mix_bgm_to_video 恢复 validate_safe_path 校验，拒绝 URL
- feat: 新增 bgm_cache 目录及自动清理策略（30天/200MB上限）
- feat: Settings 缓存清理扩展为媒体缓存（video + BGM 统一清理）
- chore: BGM url 字段改为后端必填，同步 schema/model/seed/迁移

.github/workflows/release.yml

@@ -25,6 +25,8 @@ jobs:
     name: Build macOS (Universal)
     if: ${{ github.event_name == 'push' || inputs.platform == 'all' || inputs.platform == 'macos' }}
     runs-on: macos-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -121,6 +123,8 @@ jobs:
     name: Build Windows (x64)
     if: ${{ github.event_name == 'push' || inputs.platform == 'all' || inputs.platform == 'windows' }}
     runs-on: windows-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4