android-v0.6.1

Fix playlist import missing local-control-token auth on Android

importPlaylist() used a raw fetch() instead of the shared api()
helper, so it never attached X-Local-Control-Token — the Android
host's own "Manage playlists" import button hit requireAdmin with no
credential at all and failed with "admin functions not configured"
(ADMIN_PASSWORD_HASH isn't set for local/Nearby play, so there was no
password to fall back to either). Verified in-browser: same request
now passes both requireAuth and requireAdmin (reaches the actual
gzip-parsing code instead of being rejected at the auth gate).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>