feat: security hardening, streaming overhaul, design polish, tests

Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/services/ffmpeg_session_manager.dart

@@ -0,0 +1,192 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+
+/// One running FFmpeg transcoding session (live, VOD or recording playback).
+class FfmpegSession {
+  final String id;
+  final Process process;
+  final Directory dir;
+  final bool isLive;
+  DateTime lastAccess = DateTime.now();
+  bool exited = false;
+  int? exitCode;
+
+  /// Last stderr lines, kept for fast-fail diagnostics.
+  final List<String> recentStderr = [];
+
+  FfmpegSession({
+    required this.id,
+    required this.process,
+    required this.dir,
+    required this.isLive,
+  });
+
+  void touch() => lastAccess = DateTime.now();
+}
+
+/// Registry of FFmpeg transcoding processes.
+///
+/// Responsibilities:
+/// - one process per session id (`live_{id}_{quality}`, `vod_{id}`, ...)
+/// - reaper kills sessions idle beyond a TTL (no viewer fetching segments)
+/// - startup wipe of the HLS temp dir (orphan dirs after a crash)
+/// - SIGTERM/SIGINT hook so `docker stop` leaves no orphan ffmpeg
+class FfmpegSessionManager {
+  final Directory baseDir;
+  final Map<String, FfmpegSession> _sessions = {};
+  Timer? _reaper;
+
+  static const liveIdleTimeout = Duration(minutes: 4);
+  static const vodIdleTimeout = Duration(minutes: 15);
+
+  FfmpegSessionManager(this.baseDir);
+
+  /// Wipe orphan session dirs and start the reaper. Call once at startup.
+  Future<void> init() async {
+    if (baseDir.existsSync()) {
+      try {
+        baseDir.deleteSync(recursive: true);
+      } catch (e) {
+        print('[FFmpegManager] Could not wipe temp dir: $e');
+      }
+    }
+    baseDir.createSync(recursive: true);
+
+    _reaper = Timer.periodic(const Duration(seconds: 60), (_) => _reap());
+
+    // Clean shutdown for docker stop / Ctrl+C
+    ProcessSignal.sigterm.watch().listen((_) {
+      killAll();
+      exit(0);
+    });
+    ProcessSignal.sigint.watch().listen((_) {
+      killAll();
+      exit(0);
+    });
+  }
+
+  FfmpegSession? get(String id) => _sessions[id];
+
+  /// Marks a session as recently used (call from playlist AND segment routes).
+  void touch(String id) => _sessions[id]?.touch();
+
+  bool contains(String id) => _sessions.containsKey(id);
+
+  /// Returns the existing healthy session or starts a new FFmpeg process.
+  ///
+  /// [argsBuilder] receives the session working directory and returns the
+  /// FFmpeg argument list. The session directory is recreated for new
+  /// sessions.
+  Future<FfmpegSession> getOrStart({
+    required String id,
+    required bool isLive,
+    required String ffmpegPath,
+    required List<String> Function(Directory dir) argsBuilder,
+  }) async {
+    final existing = _sessions[id];
+    if (existing != null && !existing.exited) {
+      existing.touch();
+      return existing;
+    }
+    if (existing != null) {
+      // Process died: clean up before restarting
+      killSession(id);
+    }
+
+    final dir = Directory('${baseDir.path}/$id');
+    if (dir.existsSync()) dir.deleteSync(recursive: true);
+    dir.createSync(recursive: true);
+
+    final args = argsBuilder(dir);
+    final process = await Process.start(
+      ffmpegPath,
+      args,
+      workingDirectory: dir.path,
+    );
+
+    final session = FfmpegSession(
+      id: id,
+      process: process,
+      dir: dir,
+      isLive: isLive,
+    );
+    _sessions[id] = session;
+
+    process.stderr.transform(utf8.decoder).listen((data) {
+      session.recentStderr.add(data);
+      if (session.recentStderr.length > 20) session.recentStderr.removeAt(0);
+      print('[FFmpeg $id] $data');
+    });
+
+    process.exitCode.then((code) {
+      session.exited = true;
+      session.exitCode = code;
+      print('[FFmpegManager] Session $id exited with code $code');
+    });
+
+    return session;
+  }
+
+  /// Waits until the session's playlist references at least one segment.
+  /// Fails fast when the process dies before producing output, returning
+  /// the recent stderr for diagnostics.
+  Future<({bool ready, String? error})> waitForPlaylist(
+    FfmpegSession session, {
+    Duration timeout = const Duration(seconds: 30),
+  }) async {
+    final playlistFile = File('${session.dir.path}/playlist.m3u8');
+    final deadline = DateTime.now().add(timeout);
+
+    while (DateTime.now().isBefore(deadline)) {
+      if (session.exited && session.exitCode != 0) {
+        return (
+          ready: false,
+          error: 'FFmpeg exited (${session.exitCode}): '
+              '${session.recentStderr.join().trim()}'
+        );
+      }
+      if (playlistFile.existsSync() &&
+          playlistFile.readAsStringSync().contains('.ts')) {
+        return (ready: true, error: null);
+      }
+      await Future.delayed(const Duration(milliseconds: 500));
+    }
+    return (ready: false, error: 'Timeout waiting for transcoder');
+  }
+
+  void killSession(String id) {
+    final session = _sessions.remove(id);
+    if (session == null) return;
+    try {
+      session.process.kill(ProcessSignal.sigterm);
+    } catch (_) {}
+    try {
+      if (session.dir.existsSync()) session.dir.deleteSync(recursive: true);
+    } catch (e) {
+      print('[FFmpegManager] Could not delete dir for $id: $e');
+    }
+  }
+
+  void killAll() {
+    print('[FFmpegManager] Killing ${_sessions.length} session(s)');
+    for (final id in _sessions.keys.toList()) {
+      killSession(id);
+    }
+    _reaper?.cancel();
+  }
+
+  void _reap() {
+    final now = DateTime.now();
+    for (final session in _sessions.values.toList()) {
+      final timeout = session.isLive ? liveIdleTimeout : vodIdleTimeout;
+      if (session.exited || now.difference(session.lastAccess) > timeout) {
+        print(
+          '[FFmpegManager] Reaping idle session ${session.id} '
+          '(idle ${now.difference(session.lastAccess).inSeconds}s)',
+        );
+        killSession(session.id);
+      }
+    }
+  }
+}

bin/services/recording_decision.dart

@@ -0,0 +1,33 @@
+/// Pure decision logic for the recording scheduler, extracted for testability.
+
+enum RecordingAction {
+  /// Start the recording now.
+  start,
+
+  /// Capacity reached but the window is still open: retry on a later tick.
+  wait,
+
+  /// The end time passed before the recording could start.
+  fail,
+
+  /// Not yet due — nothing to do.
+  none,
+}
+
+/// Decides what to do with a scheduled recording on a scheduler tick.
+RecordingAction decideRecordingAction({
+  required DateTime now,
+  required DateTime startTime,
+  required DateTime endTime,
+  required int activeCount,
+  required int maxConcurrent,
+}) {
+  final nowUtc = now.toUtc();
+  final startUtc = startTime.toUtc();
+  final endUtc = endTime.toUtc();
+
+  if (nowUtc.isAfter(endUtc)) return RecordingAction.fail;
+  if (!nowUtc.isAfter(startUtc)) return RecordingAction.none;
+  if (activeCount >= maxConcurrent) return RecordingAction.wait;
+  return RecordingAction.start;
+}

bin/services/recording_scheduler.dart

@@ -4,17 +4,30 @@ import 'dart:io';
 import 'package:http/http.dart' as http;
 import '../database/database.dart';
 import '../models/recording.dart';
+import '../utils/log_redactor.dart';
+import 'recording_decision.dart';
 import 'package:path/path.dart' as p;
 
+class _ActiveRecording {
+  final Recording recording;
+  final Process process;
+  _ActiveRecording(this.recording, this.process);
+}
+
 class RecordingScheduler {
   final AppDatabase _db;
   Timer? _timer;
   Timer? _seasonPassTimer;
   bool _isRunning = false;
 
-  // Stocker l'enregistrement actuellement en cours d'exécution
-  Recording? _currentRecording;
-  Process? _ffmpegProcess;
+  /// Enregistrements actuellement en cours, indexés par id.
+  final Map<String, _ActiveRecording> _active = {};
+
+  /// Nombre maximum d'enregistrements simultanés (env MAX_CONCURRENT_RECORDINGS).
+  final int maxConcurrent = int.tryParse(
+        Platform.environment['MAX_CONCURRENT_RECORDINGS'] ?? '',
+      ) ??
+      2;
 
   // Playlist config pour les appels EPG des season passes
   // Rempli depuis server.dart après initialisation
@@ -26,7 +39,8 @@ class RecordingScheduler {
 
   void start() {
     print(
-      '[RecordingScheduler] Démarrage du planificateur d\'enregistrements TV',
+      '[RecordingScheduler] Démarrage du planificateur d\'enregistrements TV '
+      '(max simultanés: $maxConcurrent)',
     );
     // Vérifier toutes les 10 secondes (pour un démarrage quasi-immédiat)
     _timer = Timer.periodic(
@@ -45,7 +59,9 @@ class RecordingScheduler {
   void stop() {
     _timer?.cancel();
     _seasonPassTimer?.cancel();
-    _stopCurrentRecording(reason: 'Arrêt du service planificateur');
+    for (final id in _active.keys.toList()) {
+      _stopActiveRecording(id, reason: 'Arrêt du service planificateur');
+    }
     print('[RecordingScheduler] Arrêté');
   }
 
@@ -58,17 +74,15 @@ class RecordingScheduler {
       final now = DateTime.now().toUtc();
 
       final recordings = _db.getAllRecordings();
-      print(
-        '[RecordingScheduler] VÉRIFICATION: now=$now recordings=${recordings.length}',
-      );
 
-      // Si un enregistrement est en cours, vérifier s'il doit s'arrêter
-      if (_currentRecording != null) {
-        if (now.isAfter(_currentRecording!.endTime.toUtc())) {
+      // Arrêter les enregistrements actifs dont l'heure de fin est passée
+      for (final id in _active.keys.toList()) {
+        final active = _active[id]!;
+        if (now.isAfter(active.recording.endTime.toUtc())) {
           print(
-            '[RecordingScheduler] Fin de l\'enregistrement : ${_currentRecording!.title}',
+            '[RecordingScheduler] Fin de l\'enregistrement : ${active.recording.title}',
           );
-          await _stopCurrentRecording();
+          _stopActiveRecording(id);
         }
       }
 
@@ -76,7 +90,7 @@ class RecordingScheduler {
       for (final recording in recordings) {
         // Nettoyer les enregistrements bloqués "recording" suite à un crash serveur
         if (recording.status == 'recording' &&
-            _currentRecording?.id != recording.id) {
+            !_active.containsKey(recording.id)) {
           print(
             '[RecordingScheduler] Enregistrement orphelin détecté: ${recording.id}',
           );
@@ -89,41 +103,38 @@ class RecordingScheduler {
         }
 
         if (recording.status == 'scheduled') {
-          final startUtc = recording.startTime.toUtc();
-          final endUtc = recording.endTime.toUtc();
-          print(
-            '[RecordingScheduler] "${recording.title}" start=$startUtc end=$endUtc now=$now isAfterStart=${now.isAfter(startUtc)} isBeforeEnd=${now.isBefore(endUtc)}',
+          final action = decideRecordingAction(
+            now: now,
+            startTime: recording.startTime,
+            endTime: recording.endTime,
+            activeCount: _active.length,
+            maxConcurrent: maxConcurrent,
           );
 
-          // Si l'enregistrement est planifié, qu'il est temps de démarrer et qu'il n'est pas déjà fini
-          if (now.isAfter(startUtc) && now.isBefore(endUtc)) {
-            if (_currentRecording != null) {
+          switch (action) {
+            case RecordingAction.start:
               print(
-                '[RecordingScheduler] Conflit: "${recording.title}" ne peut pas démarrer, "${_currentRecording!.title}" est en cours.',
+                '[RecordingScheduler] *** DÉMARRAGE DE L\'ENREGISTREMENT : ${recording.title} ***',
+              );
+              await _startRecording(recording);
+            case RecordingAction.wait:
+              // Capacité atteinte mais la fenêtre est encore ouverte :
+              // on garde le statut "scheduled" et on réessaiera au prochain tick.
+              print(
+                '[RecordingScheduler] Capacité max atteinte (${_active.length}/$maxConcurrent), '
+                '"${recording.title}" en attente.',
+              );
+            case RecordingAction.fail:
+              print(
+                '[RecordingScheduler] Enregistrement "${recording.title}" manqué (fin dépassée).',
               );
               _db.updateRecordingStatus(
                 recording.id,
                 'failed',
-                errorReason: 'Un autre enregistrement était déjà en cours.',
+                errorReason: 'Heure de fin dépassée avant le démarrage',
               );
-              continue;
-            }
-            print(
-              '[RecordingScheduler] *** DÉMARRAGE DE L\'ENREGISTREMENT : ${recording.title} ***',
-            );
-            await _startRecording(recording);
-          }
-
-          // Si l'enregistrement est planifié mais que la date de fin est dépassée (loupé)
-          if (now.isAfter(endUtc)) {
-            print(
-              '[RecordingScheduler] Enregistrement "${recording.title}" manqué (fin dépassée).',
-            );
-            _db.updateRecordingStatus(
-              recording.id,
-              'failed',
-              errorReason: 'Heure de fin dépassée avant le démarrage',
-            );
+            case RecordingAction.none:
+              break;
           }
         }
       }
@@ -223,7 +234,6 @@ class RecordingScheduler {
   }
 
   Future<void> _startRecording(Recording recording) async {
-    _currentRecording = recording;
     _db.updateRecordingStatus(recording.id, 'recording');
 
     // Un seul bloc try/catch englobant TOUT pour éviter les Unhandled exceptions
@@ -269,11 +279,12 @@ class RecordingScheduler {
       ];
 
       // Créer le fichier de log de façon sécurisée (openWrite peut lancer une exception)
+      // Le contenu du log est exposé via l'API : ne jamais y écrire de credentials.
       IOSink? logSink;
       try {
         logSink = File(logFilePath).openWrite();
         logSink.writeln('[${DateTime.now()}] Démarrage: ${recording.title}');
-        logSink.writeln('URL: $streamUrl');
+        logSink.writeln('URL: ${LogRedactor.redactUrl(streamUrl)}');
         logSink.writeln('Destination: $filePath');
       } catch (logError) {
         // Si on ne peut pas créer le log, on continue quand même (l'enregistrement reste prioritaire)
@@ -294,21 +305,24 @@ class RecordingScheduler {
         ffmpegPath = '/usr/local/bin/ffmpeg';
       }
 
-      logSink?.writeln('Commande: $ffmpegPath ${args.join(' ')}\n');
-      print('[RecordingScheduler] Exécution: $ffmpegPath ${args.join(' ')}');
+      final redactedArgs =
+          args.map(LogRedactor.redactUrl).join(' ');
+      logSink?.writeln('Commande: $ffmpegPath $redactedArgs\n');
+      print('[RecordingScheduler] Exécution: $ffmpegPath $redactedArgs');
 
-      _ffmpegProcess = await Process.start(ffmpegPath, args);
+      final process = await Process.start(ffmpegPath, args);
+      _active[recording.id] = _ActiveRecording(recording, process);
 
       // Rediriger stdout/stderr dans le log
-      _ffmpegProcess!.stdout.listen((event) => logSink?.add(event));
-      _ffmpegProcess!.stderr.listen((event) => logSink?.add(event));
+      process.stdout.listen((event) => logSink?.add(event));
+      process.stderr.listen((event) => logSink?.add(event));
 
       // Enregistrer le chemin du fichier dans la BDD
       _db.updateRecordingStatus(recording.id, 'recording', filePath: filePath);
 
       // Écouter la fin du processus FFmpeg de manière asynchrone
-      _ffmpegProcess!.exitCode.then((exitCode) async {
-        if (_currentRecording?.id == recording.id) {
+      process.exitCode.then((exitCode) async {
+        if (_active.containsKey(recording.id)) {
           logSink?.writeln(
             '\n[${DateTime.now()}] FFmpeg terminé avec le code $exitCode',
           );
@@ -329,8 +343,7 @@ class RecordingScheduler {
               errorReason: 'Erreur FFmpeg code $exitCode. Voir logs.',
             );
           }
-          _currentRecording = null;
-          _ffmpegProcess = null;
+          _active.remove(recording.id);
         } else {
           await logSink?.close();
         }
@@ -343,34 +356,30 @@ class RecordingScheduler {
         'failed',
         errorReason: 'Erreur au lancement: $e',
       );
-      _currentRecording = null;
-      _ffmpegProcess = null;
+      _active.remove(recording.id);
     }
   }
 
   /// Arrêter un enregistrement en cours (appelé depuis l'API)
   Future<bool> stopRecording(String id) async {
-    if (_ffmpegProcess != null && _currentRecording?.id == id) {
+    if (_active.containsKey(id)) {
       print(
-        '[RecordingScheduler] Arrêt demandé pour: ${_currentRecording!.title}',
+        '[RecordingScheduler] Arrêt demandé pour: ${_active[id]!.recording.title}',
       );
-      _ffmpegProcess!.kill(ProcessSignal.sigterm);
-      _db.updateRecordingStatus(id, 'completed');
-      _ffmpegProcess = null;
-      _currentRecording = null;
+      _stopActiveRecording(id);
       return true;
     }
     return false; // Pas d'enregistrement actif avec cet ID
   }
 
-  Future<void> _stopCurrentRecording({String? reason}) async {
-    if (_ffmpegProcess != null && _currentRecording != null) {
-      print('[RecordingScheduler] Arrêt auto: ${reason ?? "Fin programmée"}');
-      _ffmpegProcess!.kill(ProcessSignal.sigterm);
-      _db.updateRecordingStatus(_currentRecording!.id, 'completed');
-      _ffmpegProcess = null;
-      _currentRecording = null;
+  void _stopActiveRecording(String id, {String? reason}) {
+    final active = _active.remove(id);
+    if (active == null) return;
+    if (reason != null) {
+      print('[RecordingScheduler] Arrêt: $reason (${active.recording.title})');
     }
+    active.process.kill(ProcessSignal.sigterm);
+    _db.updateRecordingStatus(id, 'completed');
   }
 
   Future<void> _checkDiskSpaceAndRotate(Directory dir) async {