Fix arbitrary file write in /upload and /analyse_m3u_file

/upload stored files under the client-supplied filename (allowing .php
webshells and ../ traversal) and analyse_m3u_file renamed files from
unvalidated filename/id_playlist. Uploads are now always stored as
upload_<uuid>.m3u, id_playlist must be a UUID, and paths go through
safe_join.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

static/index.html

@@ -3003,6 +3003,7 @@
                     $('#add_playlist_alert').html('<div class="alert alert-success" role="alert">Upload successful!</div>');
                     var response = JSON.parse(xhr.response);
                     var id_playlist = response['id_playlist'];
+                    $("#fileName").val(response['filename']);
                     if (response.status == 'ok') {
                         $.post('analyse_m3u_file', {
                             'id_playlist': id_playlist,