feat: security hardening, streaming overhaul, design polish, tests

Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/player_mobile.html

@@ -5,8 +5,10 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
     <title>Mobile IPTV Player</title>
-    <script src="https://cdn.jsdelivr.net/npm/hls.js@1.4.12/dist/hls.min.js"></script>
-    <script src="https://cdn.jsdelivr.net/npm/mpegts.js@1.7.3/dist/mpegts.min.js"></script>
+    <!-- Vendored, pinned player libraries (no CDN dependency) -->
+    <script src="vendor/hls.min.js"></script>
+    <script src="vendor/mpegts.min.js"></script>
+    <link rel="stylesheet" href="theme.css">
     <style>
         * {
             margin: 0;
@@ -16,7 +18,7 @@
         }
 
         html, body {
-            background: #000;
+            background: var(--color-bg);
             width: 100%;
             height: 100%;
             overflow: hidden;
@@ -36,7 +38,7 @@
             width: 100%;
             height: 100%;
             object-fit: contain;
-            background: #000;
+            background: var(--color-bg);
         }
 
         #loading {
@@ -52,8 +54,8 @@
         .spinner {
             width: 40px;
             height: 40px;
-            border: 3px solid rgba(255, 255, 255, 0.2);
-            border-top-color: #fff;
+            border: 3px solid var(--color-border);
+            border-top-color: var(--color-accent);
             border-radius: 50%;
             animation: spin 0.8s cubic-bezier(0.4, 0, 0.2, 1) infinite;
             margin-bottom: 12px;
@@ -154,11 +156,11 @@
             video.volume = 1.0;
             unmuteBtn.style.display = 'none';
             log('Unmuted by user');
-            window.parent.postMessage({ type: 'unmuted' }, '*');
+            window.parent.postMessage({ type: 'unmuted' }, window.location.origin);
         });
 
         video.addEventListener('touchend', () => {
-            window.parent.postMessage({ type: 'user_activity' }, '*');
+            window.parent.postMessage({ type: 'user_activity' }, window.location.origin);
         });
 
         video.addEventListener('playing', () => {
@@ -299,6 +301,7 @@
 
         // Messages depuis Flutter
         window.addEventListener('message', (e) => {
+            if (e.origin !== window.location.origin) return;
             const d = e.data;
             if (!d) return;
             if (d.type === 'play') video.play().catch(() => {});