feat: disable direct MP3 download from customer player page

- Add controlsList=nodownload to audio elements.
- Serve audio with Content-Disposition: inline to discourage browser save dialogs.

app.py

@@ -649,7 +649,10 @@ def audio(token, version):
     path = req.get(field)
     if not path or not Path(path).exists():
         abort(404)
-    return send_from_directory(Path(path).parent, Path(path).name)
+    response = send_from_directory(Path(path).parent, Path(path).name)
+    response.headers['Content-Disposition'] = 'inline'
+    response.headers['X-Content-Type-Options'] = 'nosniff'
+    return response
 
 
 # ---------------------------------------------------------------------------