Fix: Résoudre tous les conflits d'authentification

- Nettoyer logs de debug dans auth.py
- Routes /api/audio/* : auth interne au lieu de middleware global
- /stream et /download : token obligatoire en query param (compat <audio>/<a>)
- /waveform : auth standard via header
- Polling scan/status : ajouter Authorization header
- Player : token JWT sur toutes les requêtes (waveform, stream, download)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

frontend/app/page.tsx

@@ -113,8 +113,14 @@ export default function Home() {
       // Poll scan status
       const pollInterval = setInterval(async () => {
         try {
+          const token = localStorage.getItem('access_token')
+          const pollHeaders: HeadersInit = {}
+          if (token) {
+            pollHeaders['Authorization'] = `Bearer ${token}`
+          }
+
           const statusResponse = await fetch(`${getApiUrl()}/api/library/scan/status`, {
-            headers,
+            headers: pollHeaders,
           })
           const status = await statusResponse.json()