fix(api): send session token on EPG, recordings and season-pass calls

The security hardening in 60d3f42 moved /api/epg, /api/recordings and
/api/season-passes behind authMiddleware, but the Flutter client still
called them through bare package:http. Those requests carry no
Authorization header, and on web BrowserClient sets withCredentials to
false so the session cookie is not sent either — every call came back
401. Symptoms: empty TV guide, empty recordings list, empty season
passes.

Adds AuthedHttp, a thin wrapper that injects the same token ApiClient
and XtreamService already use (localStorage['auth_token']), and routes
the 13 affected calls through it.

subtitle_service is left on plain http: it fetches third-party subtitle
URLs, not our API, and must not leak the session token.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

lib/features/iptv/widgets/recording_modal.dart

@@ -1,7 +1,7 @@
 import 'dart:convert';
 import 'package:flutter/material.dart';
 import 'package:google_fonts/google_fonts.dart';
-import 'package:http/http.dart' as http;
+import '../../../core/api/authed_http.dart';
 import '../../../core/models/iptv_models.dart';
 import '../../../core/theme/app_colors.dart';
 import '../../../core/widgets/glass_container.dart';
@@ -45,7 +45,7 @@ class _RecordingModalState extends State<RecordingModal> {
     
     try {
       // Utilisation d'une URL relative en Web (ou d'une configuration pour autres plateformes)
-      final response = await http.post(
+      final response = await AuthedHttp.post(
         Uri.parse('/api/recordings'),
         headers: {'Content-Type': 'application/json'},
         body: json.encode({