feat: security hardening, streaming overhaul, design polish, tests

Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/test/log_redactor_test.dart

@@ -0,0 +1,33 @@
+import 'package:test/test.dart';
+import '../utils/log_redactor.dart';
+
+void main() {
+  group('LogRedactor.redactUrl', () {
+    test('masks credentials in query strings', () {
+      final out = LogRedactor.redactUrl(
+        'http://srv:8080/player_api.php?username=john&password=hunter2&action=get_live_streams',
+      );
+      expect(out, isNot(contains('john')));
+      expect(out, isNot(contains('hunter2')));
+      expect(out, contains('username=***'));
+      expect(out, contains('password=***'));
+      expect(out, contains('action=get_live_streams'));
+    });
+
+    test('masks credentials in live/movie/series path segments', () {
+      for (final kind in ['live', 'movie', 'series']) {
+        final out = LogRedactor.redactUrl(
+          'http://srv:8080/$kind/john/hunter2/12345.ts',
+        );
+        expect(out, isNot(contains('john')), reason: kind);
+        expect(out, isNot(contains('hunter2')), reason: kind);
+        expect(out, contains('/$kind/***/***/12345.ts'), reason: kind);
+      }
+    });
+
+    test('leaves URLs without credentials untouched', () {
+      const url = 'http://srv:8080/images/logo.png';
+      expect(LogRedactor.redactUrl(url), url);
+    });
+  });
+}

bin/test/password_hasher_test.dart

@@ -0,0 +1,37 @@
+import 'dart:convert';
+import 'package:crypto/crypto.dart';
+import 'package:test/test.dart';
+import '../utils/password_hasher.dart';
+
+void main() {
+  group('PasswordHasher', () {
+    test('bcrypt roundtrip verifies the original password', () {
+      final hash = PasswordHasher.hash('s3cret-Pass!');
+      expect(hash, startsWith(r'$2'));
+      expect(PasswordHasher.verify('s3cret-Pass!', hash), isTrue);
+      expect(PasswordHasher.verify('wrong', hash), isFalse);
+    });
+
+    test('legacy unsalted SHA-256 hashes still verify', () {
+      final legacy = sha256.convert(utf8.encode('admin')).toString();
+      expect(PasswordHasher.verify('admin', legacy), isTrue);
+      expect(PasswordHasher.verify('not-admin', legacy), isFalse);
+    });
+
+    test('isLegacy detects SHA-256 hex digests only', () {
+      final legacy = sha256.convert(utf8.encode('admin')).toString();
+      expect(PasswordHasher.isLegacy(legacy), isTrue);
+      expect(PasswordHasher.isLegacy(PasswordHasher.hash('admin')), isFalse);
+    });
+
+    test('rehash produces a non-legacy hash', () {
+      final rehashed = PasswordHasher.hash('admin');
+      expect(PasswordHasher.isLegacy(rehashed), isFalse);
+      expect(PasswordHasher.verify('admin', rehashed), isTrue);
+    });
+
+    test('malformed hash never verifies', () {
+      expect(PasswordHasher.verify('x', 'garbage-hash'), isFalse);
+    });
+  });
+}

bin/test/recording_decision_test.dart

@@ -0,0 +1,73 @@
+import 'package:test/test.dart';
+import '../services/recording_decision.dart';
+
+void main() {
+  final now = DateTime.utc(2026, 6, 10, 12, 0);
+
+  group('decideRecordingAction', () {
+    test('starts when due and capacity available', () {
+      expect(
+        decideRecordingAction(
+          now: now,
+          startTime: now.subtract(const Duration(minutes: 1)),
+          endTime: now.add(const Duration(hours: 1)),
+          activeCount: 0,
+          maxConcurrent: 2,
+        ),
+        RecordingAction.start,
+      );
+    });
+
+    test('waits (keeps scheduled) when at capacity but window still open', () {
+      expect(
+        decideRecordingAction(
+          now: now,
+          startTime: now.subtract(const Duration(minutes: 1)),
+          endTime: now.add(const Duration(hours: 1)),
+          activeCount: 2,
+          maxConcurrent: 2,
+        ),
+        RecordingAction.wait,
+      );
+    });
+
+    test('fails when the end time has passed', () {
+      expect(
+        decideRecordingAction(
+          now: now,
+          startTime: now.subtract(const Duration(hours: 2)),
+          endTime: now.subtract(const Duration(minutes: 5)),
+          activeCount: 0,
+          maxConcurrent: 2,
+        ),
+        RecordingAction.fail,
+      );
+    });
+
+    test('does nothing before the start time', () {
+      expect(
+        decideRecordingAction(
+          now: now,
+          startTime: now.add(const Duration(minutes: 30)),
+          endTime: now.add(const Duration(hours: 1)),
+          activeCount: 0,
+          maxConcurrent: 2,
+        ),
+        RecordingAction.none,
+      );
+    });
+
+    test('second overlapping recording starts when maxConcurrent is 2', () {
+      expect(
+        decideRecordingAction(
+          now: now,
+          startTime: now.subtract(const Duration(minutes: 1)),
+          endTime: now.add(const Duration(hours: 1)),
+          activeCount: 1,
+          maxConcurrent: 2,
+        ),
+        RecordingAction.start,
+      );
+    });
+  });
+}

bin/test/safe_path_test.dart

@@ -0,0 +1,40 @@
+import 'package:test/test.dart';
+import '../utils/safe_path.dart';
+
+void main() {
+  group('SafePath.resolveWithin', () {
+    const base = '/app/recordings';
+
+    test('accepts files inside the base directory', () {
+      expect(
+        SafePath.resolveWithin(base, '/app/recordings/show.log'),
+        isNotNull,
+      );
+      expect(SafePath.resolveWithin(base, 'show.log'), isNotNull);
+      expect(
+        SafePath.resolveWithin(base, '/app/recordings/sub/dir/file.log'),
+        isNotNull,
+      );
+    });
+
+    test('rejects .. traversal', () {
+      expect(
+        SafePath.resolveWithin(base, '/app/recordings/../data/xtremflow.db'),
+        isNull,
+      );
+      expect(SafePath.resolveWithin(base, '../../etc/passwd'), isNull);
+    });
+
+    test('rejects absolute paths outside the base', () {
+      expect(SafePath.resolveWithin(base, '/etc/passwd'), isNull);
+      expect(SafePath.resolveWithin(base, '/app/data/xtremflow.db'), isNull);
+    });
+
+    test('rejects sibling directories with a shared prefix', () {
+      expect(
+        SafePath.resolveWithin(base, '/app/recordings-evil/file.log'),
+        isNull,
+      );
+    });
+  });
+}

bin/test/ssrf_test.dart

@@ -0,0 +1,29 @@
+import 'package:test/test.dart';
+import '../api/proxy_handler.dart';
+
+void main() {
+  group('isForbiddenProxyHost', () {
+    test('blocks loopback', () {
+      expect(isForbiddenProxyHost('127.0.0.1'), isTrue);
+      expect(isForbiddenProxyHost('localhost'), isTrue);
+      expect(isForbiddenProxyHost('::1'), isTrue);
+    });
+
+    test('blocks private LAN ranges', () {
+      expect(isForbiddenProxyHost('10.0.0.5'), isTrue);
+      expect(isForbiddenProxyHost('172.16.0.1'), isTrue);
+      expect(isForbiddenProxyHost('172.31.255.255'), isTrue);
+      expect(isForbiddenProxyHost('192.168.1.10'), isTrue);
+    });
+
+    test('blocks link-local / cloud metadata range', () {
+      expect(isForbiddenProxyHost('169.254.169.254'), isTrue);
+    });
+
+    test('allows public IPs and hostnames', () {
+      expect(isForbiddenProxyHost('8.8.8.8'), isFalse);
+      expect(isForbiddenProxyHost('172.32.0.1'), isFalse);
+      expect(isForbiddenProxyHost('cdn.example.com'), isFalse);
+    });
+  });
+}