chore(submodule): bump media-server to d131ba4
Includes v0.2.6, v0.2.7, the recent CSP fix, and the production-readiness hardening pass (security scopes + rate limit, audit log, request IDs, HTTPS/proxy-header config, album-art cache, mediaSession API, and 35 new tests). Leaves haos-integration submodule pointer untouched.
This commit is contained in: