v3.0.34

Security hardening

• Closed self-update writable-repo vector, brute-force XFF bypass, missing Host allowlist (with ngrok + WebSocket coverage), non-consensual telemetry, and a pickle RCE risk in OrpheusDL session loading.

Fixes

• BBC Sounds downloads now pull real ~2x higher fidelity audio (was silently capped by a MediaSelector quality-tier mislabel).
• Fixed a crash in AppleMusicDecrypt when a track has no Hi-Res/Atmos master.
• Spotify to Deezer/Apple conversion (incl. release radar downloads) no longer serves unrelated releases that merely share words in the title -- now matches by real ISRC/UPC first.