Arbitrary file execution via shell.openPath fallback

Sandbox escape in the open-path-at-time IPC handler in Streambert before 2.6.0 allows local users to execute arbitrary files via a crafted filePath. In src/ipc/player.js, the handler accepts a renderer-controlled path without type or location checks and, when mpv or VLC launch is skipped or fails, passes that path to Electron's shell.openPath for operating-system handling. Exploitation requires control of a renderer process but no further user interaction; a local executable, script, or shortcut reachable by the Streambert process can then run with that process's privileges outside the renderer sandbox.