feat: security hardening, streaming overhaul, design polish, tests

Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/middleware/auth_middleware.dart

@@ -1,3 +1,4 @@
+import 'dart:io';
 import 'package:shelf/shelf.dart';
 import '../database/database.dart';
 
@@ -16,16 +17,20 @@ Middleware authMiddleware(AppDatabase db) {
         return Response(401, body: 'Unauthorized');
       }
 
-      // Verify session
+      // Verify session (findSessionByToken enforces expires_at)
       final session = db.findSessionByToken(token);
       if (session == null) {
         return Response(401, body: 'Invalid or expired session');
       }
 
-      // Add userId to context
+      // Add user info to context. Both keys are populated because handlers
+      // are inconsistent: playlists_handler reads 'userId', while
+      // getPlaylist/admin routes read 'user'.
+      final user = db.findUserById(session.userId);
       final updatedRequest = request.change(context: {
         ...request.context,
         'userId': session.userId,
+        if (user != null) 'user': user,
       },);
 
       return handler(updatedRequest);
@@ -33,6 +38,33 @@ Middleware authMiddleware(AppDatabase db) {
   };
 }
 
+/// Auth middleware for streaming routes (HLS playlists/segments).
+///
+/// hls.js/mpegts.js inside the player iframe cannot send Authorization
+/// headers, so these routes accept the HttpOnly session cookie instead.
+/// Loopback requests without X-Forwarded-For are allowed through because
+/// the recording scheduler's local FFmpeg fetches
+/// `http://localhost:8089/api/live/<id>.ts` without credentials.
+Middleware streamAuthMiddleware(AppDatabase db) {
+  return (Handler handler) {
+    return (Request request) async {
+      final connectionInfo =
+          request.context['shelf.io.connection_info'] as HttpConnectionInfo?;
+      final isLoopback = connectionInfo?.remoteAddress.isLoopback ?? false;
+      final viaProxy = request.headers.containsKey('x-forwarded-for');
+      if (isLoopback && !viaProxy) {
+        return handler(request);
+      }
+
+      final token = _extractToken(request);
+      if (token == null || db.findSessionByToken(token) == null) {
+        return Response(401, body: 'Unauthorized');
+      }
+      return handler(request);
+    };
+  };
+}
+
 /// Extract token from Authorization header or cookie
 String? _extractToken(Request request) {
   // Try Authorization header first

bin/middleware/security_middleware.dart

@@ -1,12 +1,27 @@
 import 'package:shelf/shelf.dart';
 import 'dart:async';
+import 'dart:io';
 
 /// Security Middleware Collection
-/// 
+///
 /// Includes:
 /// - Honeypot Routes (Trap for bots)
-/// - Security Headers (HSTS, XSS Protection)
+/// - Security Headers (HSTS, XSS Protection, CSP Report-Only)
 /// - Rate Limiting (Basic DoS protection)
+/// - Login-specific rate limiting (brute-force protection)
+
+/// Resolve the real client IP.
+/// Honors the first hop of X-Forwarded-For when behind nginx, otherwise
+/// falls back to the socket connection info.
+String clientIpOf(Request request) {
+  final forwarded = request.headers['x-forwarded-for'];
+  if (forwarded != null && forwarded.isNotEmpty) {
+    return forwarded.split(',').first.trim();
+  }
+  final connectionInfo =
+      request.context['shelf.io.connection_info'] as HttpConnectionInfo?;
+  return connectionInfo?.remoteAddress.address ?? 'unknown';
+}
 
 /// 1. Security Headers Middleware
 /// Adds standard security headers to every response.
@@ -14,15 +29,24 @@ Middleware securityHeadersMiddleware() {
   return (Handler handler) {
     return (Request request) async {
       final response = await handler(request);
-      
+
       return response.change(headers: {
         'X-Content-Type-Options': 'nosniff',
-        'X-Frame-Options': 'SAMEORIGIN', // Changed from DENY to allow embedding player.html
+        'X-Frame-Options': 'SAMEORIGIN', // Allow embedding player.html iframes
         'X-XSS-Protection': '1; mode=block',
         'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload',
         'Referrer-Policy': 'strict-origin-when-cross-origin',
-        // Note: CSP is tricky with Flutter Web (requires 'unsafe-eval' for Dart),
-        // so we omit it here to avoid breaking the app, or use a permissive one.
+        // Report-Only first: Flutter Web (CanvasKit/wasm) and google_fonts
+        // can break under an enforcing CSP. Promote to enforcing only after
+        // a clean soak with no violations in browser consoles.
+        'Content-Security-Policy-Report-Only':
+            "default-src 'self'; "
+            "script-src 'self' 'wasm-unsafe-eval' 'unsafe-eval'; "
+            "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
+            "font-src 'self' https://fonts.gstatic.com; "
+            "img-src 'self' data: blob: https:; "
+            "media-src 'self' blob:; "
+            "connect-src 'self' https://fonts.gstatic.com",
       },);
     };
   };
@@ -48,15 +72,15 @@ Middleware honeypotMiddleware() {
   return (Handler handler) {
     return (Request request) {
       final path = request.url.path;
-      
+
       // Check if path contains any honeypot target
       for (final trap in honeypotPaths) {
         if (path.contains(trap.replaceAll('/', ''))) { // Simple check
-          print('SECURITY ALERT: Honeypot triggered by ${request.context['clientIp'] ?? 'unknown IP'} on path: $path');
+          print('SECURITY ALERT: Honeypot triggered by ${clientIpOf(request)} on path: $path');
           return Response.forbidden('Access Denied');
         }
       }
-      
+
       return handler(request);
     };
   };
@@ -64,10 +88,10 @@ Middleware honeypotMiddleware() {
 
 /// 3. Rate Limit Middleware (In-Memory)
 /// Limits requests per IP address.
-/// Default: 100 requests per minute per IP.
+/// Default: 200 requests per minute per IP.
 Middleware rateLimitMiddleware({int requestsPerMinute = 200}) {
   final clientRequests = <String, List<DateTime>>{};
-  
+
   // Cleanup timer to remove old entries and prevent memory leaks
   Timer.periodic(const Duration(minutes: 5), (_) {
     final now = DateTime.now();
@@ -80,26 +104,23 @@ Middleware rateLimitMiddleware({int requestsPerMinute = 200}) {
 
   return (Handler handler) {
     return (Request request) {
-      // Identify client by IP (passed from main server or headers)
-      // Note: In real prod behind Nginx, use X-Forwarded-For
-      // Here we assume direct or standard setup.
-      final clientIp = (request.context['clientIp'] as String?) ?? 'unknown';
-      
+      final clientIp = clientIpOf(request);
+
       if (clientIp != 'unknown' && clientIp != '127.0.0.1') {
          final now = DateTime.now();
-         
+
          // Get or create history for this IP
          final history = clientRequests.putIfAbsent(clientIp, () => []);
-         
+
          // Clean old requests (older than 1 minute)
          history.removeWhere((t) => now.difference(t).inMinutes >= 1);
-         
+
          // Check limit
          if (history.length >= requestsPerMinute) {
            print('SECURITY WARN: Rate limit exceeded for $clientIp');
            return Response(429, body: 'Too Many Requests');
          }
-         
+
          // Add current request
          history.add(now);
       }
@@ -108,3 +129,45 @@ Middleware rateLimitMiddleware({int requestsPerMinute = 200}) {
     };
   };
 }
+
+/// 4. Login Rate Limit Middleware
+/// Strict per-IP limit on login attempts (brute-force protection),
+/// plus a small delay on each attempt to slow credential stuffing.
+Middleware loginRateLimitMiddleware({int attemptsPerMinute = 10}) {
+  final attempts = <String, List<DateTime>>{};
+
+  Timer.periodic(const Duration(minutes: 5), (_) {
+    final now = DateTime.now();
+    attempts.removeWhere((_, times) {
+      times.removeWhere((t) => now.difference(t).inMinutes > 1);
+      return times.isEmpty;
+    });
+  });
+
+  return (Handler handler) {
+    return (Request request) async {
+      // Only throttle the login POST; other auth routes pass through
+      if (!(request.method == 'POST' && request.url.path.endsWith('login'))) {
+        return handler(request);
+      }
+
+      final clientIp = clientIpOf(request);
+      final now = DateTime.now();
+      final history = attempts.putIfAbsent(clientIp, () => []);
+      history.removeWhere((t) => now.difference(t).inMinutes >= 1);
+
+      if (history.length >= attemptsPerMinute) {
+        print('SECURITY WARN: Login rate limit exceeded for $clientIp');
+        return Response(429, body: 'Too many login attempts. Try again later.');
+      }
+      history.add(now);
+
+      final response = await handler(request);
+      if (response.statusCode == 401) {
+        // Slow down brute-force attempts on failed logins
+        await Future.delayed(const Duration(milliseconds: 300));
+      }
+      return response;
+    };
+  };
+}