feat: security hardening, streaming overhaul, design polish, tests

Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/api/xtream_api_handler.dart

@@ -0,0 +1,78 @@
+import 'dart:convert';
+import 'package:shelf/shelf.dart';
+import 'package:http/http.dart' as http;
+import '../models/playlist_config.dart';
+import '../utils/log_redactor.dart';
+
+/// Authenticated gateway to the Xtream `player_api.php` endpoint.
+///
+/// The frontend never sees the Xtream credentials: it calls
+/// `GET /api/xtream-api?action=...` with its session token and the server
+/// injects the username/password of the user's playlist before forwarding.
+class XtreamApiHandler {
+  final Future<PlaylistConfig?> Function(Request) _getPlaylist;
+  final http.Client _client = http.Client();
+
+  XtreamApiHandler(this._getPlaylist);
+
+  /// Query parameters the client is allowed to pass through to Xtream.
+  static const _allowedParams = {
+    'action',
+    'category_id',
+    'stream_id',
+    'series_id',
+    'vod_id',
+    'limit',
+    'type',
+  };
+
+  Future<Response> handle(Request request) async {
+    final playlist = await _getPlaylist(request);
+    if (playlist == null) {
+      return Response.forbidden(
+        jsonEncode({'error': 'No playlist configured'}),
+        headers: {'Content-Type': 'application/json'},
+      );
+    }
+
+    final params = <String, String>{
+      'username': playlist.username,
+      'password': playlist.password,
+    };
+    request.url.queryParameters.forEach((key, value) {
+      if (_allowedParams.contains(key)) params[key] = value;
+    });
+
+    final base = Uri.parse('${playlist.dns}/player_api.php');
+    final targetUrl = base.replace(queryParameters: params);
+
+    try {
+      final proxyRequest = http.Request('GET', targetUrl)
+        ..headers['User-Agent'] = 'VLC/3.0.18 LibVLC/3.0.18'
+        ..headers['Accept'] = '*/*'
+        ..followRedirects = true;
+
+      final response = await _client
+          .send(proxyRequest)
+          .timeout(const Duration(seconds: 90));
+
+      return Response(
+        response.statusCode,
+        body: response.stream,
+        headers: {
+          'Content-Type':
+              response.headers['content-type'] ?? 'application/json',
+          'Cache-Control': 'no-store',
+        },
+      );
+    } catch (e) {
+      print(
+        '[XtreamApi] Error forwarding to ${LogRedactor.redactUrl(targetUrl.toString())}: $e',
+      );
+      return Response.internalServerError(
+        body: jsonEncode({'error': 'Upstream Xtream API error'}),
+        headers: {'Content-Type': 'application/json'},
+      );
+    }
+  }
+}