feat: security hardening, streaming overhaul, design polish, tests

Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/api/recordings_api.dart

@@ -1,9 +1,11 @@
 import 'dart:io';
 import 'dart:convert';
+import 'package:path/path.dart' as p;
 import 'package:shelf/shelf.dart';
-import 'package:shelf_router/shelf_router.dart';
 import '../database/database.dart';
+import '../models/user.dart';
 import '../services/recording_scheduler.dart';
+import '../utils/safe_path.dart';
 
 class RecordingsApi {
   final AppDatabase _db;
@@ -30,12 +32,24 @@ class RecordingsApi {
       );
     }
 
-    final logFilePath = recording.filePath!.replaceAll('.mp4', '.log');
-    final logFile = File(logFilePath);
+    // Les enregistrements sont écrits en .mkv avec un .log à côté
+    // (l'ancien replaceAll('.mp4', '.log') ne trouvait jamais le fichier).
+    final logFilePath = p.setExtension(recording.filePath!, '.log');
+
+    // Anti path-traversal : le log doit rester dans /app/recordings
+    final safeLogPath = SafePath.resolveWithin('/app/recordings', logFilePath);
+    if (safeLogPath == null) {
+      return Response.forbidden(
+        json.encode({'error': 'Chemin de log invalide'}),
+        headers: {'Content-Type': 'application/json'},
+      );
+    }
+
+    final logFile = File(safeLogPath);
 
     if (!await logFile.exists()) {
       return Response.notFound(
-        json.encode({'error': 'Le fichier de log est introuvable. Chemin: $logFilePath'}),
+        json.encode({'error': 'Le fichier de log est introuvable.'}),
         headers: {'Content-Type': 'application/json'},
       );
     }
@@ -47,9 +61,13 @@ class RecordingsApi {
     );
   }
 
-  /// GET /api/recordings — Liste tous les enregistrements
+  /// GET /api/recordings — Liste les enregistrements de l'utilisateur
+  /// (tous les enregistrements pour un admin)
   Response handleGetAll(Request request) {
-    final recordings = _db.getAllRecordings();
+    final user = request.context['user'] as User?;
+    final recordings = (user != null && !user.isAdmin)
+        ? _db.getUserRecordings(user.id)
+        : _db.getAllRecordings();
     return Response.ok(
       json.encode(recordings.map((r) => r.toMap()).toList()),
       headers: {'Content-Type': 'application/json'},
@@ -62,8 +80,9 @@ class RecordingsApi {
       final payload = await request.readAsString();
       final data = json.decode(payload);
 
+      final userId = request.context['userId'] as String? ?? 'dev_user_id';
       final recording = _db.createRecording(
-        userId: 'dev_user_id',
+        userId: userId,
         channelId: data['channel_id'],
         streamUrl: data['stream_url'],
         title: data['title'] ?? 'Sans Titre',