clementine: 2 CWE-407 defects; mpd + rhythmbox CLEAN

clementine-0001: LibraryWatcher ScanSubdirectory FindSongByPath O(F*S) +
files_on_disk.contains O(S*F) — linear scan with TODO comment, fix with
HashMap + HashSet. HIGH severity, 250x at N=1000.

clementine-0002: SongSender indexOf(s) O(N^2) in SendAlbum/SendPlaylist/
SendUrls loops — fix with integer counter + QSet for requested_ids.
MEDIUM severity, 500x at N=1000.

MPD: CLEAN — uses std::set, bitmask arrays, std::map throughout.
Rhythmbox: CLEAN — uses g_hash_table for all membership checks.

4/4 unit tests PASS.

defects/mpd/patch/CLEAN.md

@@ -0,0 +1,21 @@
+# MPD (Music Player Daemon) - CWE-407 Scan Result: CLEAN
+
+Scanned: 2026-03-30
+Source: https://github.com/MusicPlayerDaemon/MPD (depth=1)
+
+## Scan Summary
+
+MPD is well-engineered with respect to data structure choices:
+
+- **Tag type lookups**: Uses bitmask arrays (`TagMask`) for O(1) membership testing
+- **Protocol list**: Uses `std::set` for dedup
+- **Property model**: Uses `g_hash_table` (via libmpd) for O(1) lookups
+- **Keyword tracking**: Uses `g_hash_table` for entry-keyword mapping
+- **Playlist dedup**: Uses hash-based `location_in_map` via `g_hash_table`
+- **Input cache**: Uses `std::map` (`items_by_uri`) for URI lookups
+- **Event polling**: Uses `std::map` for fd-to-pollfd mapping
+
+The few `std::find` calls found operate on bounded-size collections
+(tag_types, ~30 entries max) and are not inside scaling loops.
+
+No CWE-407 defects found.