feat: security hardening, streaming overhaul, design polish, tests

Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/utils/log_redactor.dart

@@ -0,0 +1,29 @@
+/// Redacts IPTV credentials from URLs before they reach logs.
+///
+/// Xtream Codes embeds credentials both in query strings
+/// (`?username=u&password=p`) and in path segments
+/// (`/live/<user>/<pass>/<id>.ts`, `/movie/...`, `/series/...`).
+class LogRedactor {
+  static final RegExp _queryCreds = RegExp(
+    r'(username|password)=[^&\s]*',
+    caseSensitive: false,
+  );
+
+  static final RegExp _pathCreds = RegExp(
+    r'/(live|movie|series)/[^/\s]+/[^/\s]+/',
+    caseSensitive: false,
+  );
+
+  /// Returns [url] with credentials replaced by `***`.
+  static String redactUrl(String url) {
+    var redacted = url.replaceAllMapped(
+      _queryCreds,
+      (m) => '${m.group(1)}=***',
+    );
+    redacted = redacted.replaceAllMapped(
+      _pathCreds,
+      (m) => '/${m.group(1)}/***/***/',
+    );
+    return redacted;
+  }
+}

bin/utils/password_hasher.dart

@@ -1,17 +1,35 @@
 import 'dart:convert';
+import 'package:bcrypt/bcrypt.dart';
 import 'package:crypto/crypto.dart';
 
 class PasswordHasher {
-  /// Hash a password using SHA256 (simple implementation)
-  /// Note: In production, use a proper bcrypt implementation
+  /// Cost factor 10: ~100-300ms per hash in pure Dart, acceptable for login frequency.
+  static const int _bcryptRounds = 10;
+
+  /// Legacy hashes are unsalted SHA-256 hex digests (64 hex chars).
+  static final RegExp _legacyPattern = RegExp(r'^[0-9a-f]{64}$');
+
+  /// Hash a password using bcrypt (salt embedded in the result).
   static String hash(String password) {
-    final bytes = utf8.encode(password);
-    final digest = sha256.convert(bytes);
-    return digest.toString();
+    return BCrypt.hashpw(password, BCrypt.gensalt(logRounds: _bcryptRounds));
   }
 
-  /// Verify a password against a hash
+  /// Verify a password against a stored hash.
+  /// Supports legacy unsalted SHA-256 hashes for accounts created before
+  /// the bcrypt migration; those are rehashed lazily on successful login.
   static bool verify(String password, String hash) {
-    return PasswordHasher.hash(password) == hash;
+    if (isLegacy(hash)) {
+      final digest = sha256.convert(utf8.encode(password)).toString();
+      return digest == hash;
+    }
+    try {
+      return BCrypt.checkpw(password, hash);
+    } catch (_) {
+      // Malformed hash (neither legacy SHA-256 nor valid bcrypt)
+      return false;
+    }
   }
+
+  /// True if the stored hash uses the legacy unsalted SHA-256 scheme.
+  static bool isLegacy(String hash) => _legacyPattern.hasMatch(hash);
 }

bin/utils/safe_path.dart

@@ -0,0 +1,18 @@
+import 'package:path/path.dart' as p;
+
+/// Path validation helpers to prevent directory traversal.
+class SafePath {
+  /// Resolves [candidate] and returns it only if it stays inside [baseDir].
+  /// Returns null when the path escapes the base directory (e.g. via `..`
+  /// segments or an absolute path pointing elsewhere).
+  static String? resolveWithin(String baseDir, String candidate) {
+    final base = p.normalize(p.absolute(baseDir));
+    final resolved = p.normalize(
+      p.isAbsolute(candidate) ? candidate : p.join(base, candidate),
+    );
+    if (resolved == base || p.isWithin(base, resolved)) {
+      return resolved;
+    }
+    return null;
+  }
+}