Refactor cover art handling and improve accessibility

- Extract cover art fetching logic into a dedicated useCoverArt hook
- Replace duplicate cover art fetching code in MopidyPanel with the new hook
- Improve accessibility in App.jsx by using proper ARIA attributes (aria-selected, role="tab")
- Add Flask dependency to requirements.txt for now-playing service
- Add Content-Length limit to bandcamp-api to prevent DoS attacks
- Remove MopidyPanel.jsx.bak file

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

bandcamp-api/app.py

@@ -126,7 +126,7 @@ class _Handler(BaseHTTPRequestHandler):
             self._json(404, {"error": "not found"})
 
     def do_POST(self):
-        length = int(self.headers.get("Content-Length", 0))
+        length = min(int(self.headers.get("Content-Length", 0)), 65536)
         try:
             body = json.loads(self.rfile.read(length) or b"{}")
         except json.JSONDecodeError: