Refactor: Backend-Optimierungen + Volume-Debounce

- /api/play delegiert an playFilePath() statt ~120 Zeilen Duplikat-Code (inkl. fehlende Loudnorm)
- safeSoundsPath() Helfer gegen Path-Traversal bei Admin delete/rename
- writePersistedStateDebounced() reduziert Disk-I/O bei Play-Countern (2s Debounce)
- /api/sounds nutzt listAllSounds() statt duplizierte Dateisystem-Scans
- /api/play-url vor catch-all Route verschoben (war unreachable in Produktion)
- Frontend Volume-Slider mit 120ms Debounce (weniger API-Calls beim Ziehen)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/src/App.tsx

@@ -62,6 +62,7 @@ export default function App() {
   const [chaosMode, setChaosMode] = useState(false);
   const [partyActiveGuilds, setPartyActiveGuilds] = useState<string[]>([]);
   const chaosModeRef = useRef(false);
+  const volDebounceRef = useRef<ReturnType<typeof setTimeout>>();
 
   /* ── Admin ── */
   const [isAdmin, setIsAdmin] = useState(false);
@@ -626,10 +627,15 @@ export default function App() {
             max={1}
             step={0.01}
             value={volume}
-            onChange={async e => {
+            onChange={e => {
               const v = parseFloat(e.target.value);
               setVolume(v);
-              if (guildId) try { await setVolumeLive(guildId, v); } catch { }
+              if (guildId) {
+                if (volDebounceRef.current) clearTimeout(volDebounceRef.current);
+                volDebounceRef.current = setTimeout(() => {
+                  setVolumeLive(guildId, v).catch(() => {});
+                }, 120);
+              }
             }}
             style={{ '--vol': `${Math.round(volume * 100)}%` } as React.CSSProperties}
           />