fix: escape Content-Disposition filenames and guard malformed align responses

[carochacs]

What

Two small robustness/security fixes found during a prior security audit:

• ls_export: title/artist were inserted into Content-Disposition: filename="{safe_name}.lrc" without escaping ", so a quote in title/artist could break out of the quoted filename parameter and corrupt the download filename. Now escapes "/\ for the legacy filename= fallback and adds an RFC 5987 filename*=UTF-8''... form.
• ls_align: resp.json() wasn't wrapped in a try/except, so a non-JSON response from the configured align server produced an unhandled 500. Now returns a clean 502 on a malformed response.

Fixes #7, Fixes #8

Checklist

• Verified routes.py parses (python3 -c "import ast; ast.parse(...)")
• Bumped plugin.json version (1.0.1 → 1.0.2)

---

Generated by Claude Code

[pullfrog]

ℹ️ Minor suggestions only — both fixes are sound.

Reviewed changes

• ls_align malformed-response guard (routes.py:223-229): wraps resp.json() in a try/except ValueError, returning a clean 502 instead of an unhandled 500 when the alignment server returns non-JSON. Correct exception to catch (JSONDecodeError inherits from ValueError in requests).
• ls_export Content-Disposition escaping (routes.py:270-283): escapes " and \ in the legacy filename= parameter, and adds an RFC 5987 filename*=UTF-8''... form with urllib.parse.quote for non-ASCII names. Standard and correct approach.

  ^{｜ View workflow run ｜ Using Big Pickle (free) ｜ 𝕏}