[playback] Add HLS support and stop blaming stale MediaErrors

bitvid attached every hosted source with `videoEl.src = url`, which only plays
HLS on Safari-family browsers. Firefox 146 fails with MEDIA_ERR_SRC_NOT_SUPPORTED
(canPlayType returns ""), so every .m3u8 note -- e.g. anything published by
nostube/slidestr -- was unplayable there and the URL-health badge showed
"offline". Chrome/Brave 149 happen to play HLS natively, which is why this
looked browser-specific.

Vendor hls.js (npm run build:hls) and route HLS sources through it:

- js/services/hlsPlayback.js owns detection, engine choice and the hls.js
  lifecycle. Engine choice keys off MediaSource, NOT canPlayType: Chrome
  returns "maybe" for every HLS type, so a native-first branch would hang.
  Native is used only when MSE is genuinely unavailable.
- The bundle is the FULL build, not hls.js/light -- light drops the alternate
  audio stream controller and real ladders demux audio into an EXT-X-MEDIA
  group. It is lazy-imported only when a .m3u8 is encountered, so ordinary
  MP4/WebTorrent playback never pays the ~500KB.
- modalCoordinator tears the instance down first; clearing `src` alone leaves
  the transmuxing worker and segment fetches running after the modal closes.
- urlHealthController probes HLS by fetching the playlist for #EXTM3U. The old
  bare-<video> probe could not load it and on Chrome emitted no events at all,
  burning the full timeout on every HLS card.
- HLS_PLAYBACK_START_TIMEOUT widens the 3s start window, which fired
  mid-startup: the bundle, master playlist, variant playlist, init segment and
  first media segment are four-plus serial round trips.

Also fixes two bugs found while verifying this:

- A stale MediaError was reported as the current failure. Teardown clears `src`
  and calls load(), leaving MEDIA_ERR_SRC_NOT_SUPPORTED ("Empty src attribute")
  on the element; a later watchdog fallback rendered that as "Hosted playback
  failed: source not supported or blocked." over a stream that was playing
  fine. Only a MediaError produced by the current attempt is surfaced now.
  Sources are also bound before the watchdogs are armed, so hls.js's own
  attachMedia() src swap cannot read as a playback failure.
- `audio/x-mpegurl` is a legacy alias for an HLS playlist of any kind, not an
  audio-only assertion. isAudioOnlyVideoObject misfiled HLS video ladders
  published with it as podcasts and dropped them from every video feed.

Verified end-to-end in Chromium, Chrome 149, Brave 149 and Firefox 146 against
a live HLS stream: Firefox goes from "No playable source found." to playing.
Rollback: stop calling attachHlsSource() and the previous `src` assignment
returns; see docs/playback-fallback.md.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

scripts/build-hls.mjs

@@ -0,0 +1,46 @@
+// Bundles hls.js into a single self-contained ESM file that bitvid lazy-imports
+// the first time a viewer opens an HLS (.m3u8) source. Mirrors the
+// blossom-sdk / bitcoin-connect / floating-ui vendor steps. Pinned via the exact
+// devDependency version in package.json.
+//
+// Lazy-import is the whole point: hls.js is ~530KB minified, and the vast
+// majority of bitvid videos are progressive MP4 or WebTorrent. Nothing here may
+// be imported from a module that loads on boot.
+import { build } from "esbuild";
+import { mkdir, copyFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const entryPoint = path.join(repoRoot, "scripts/vendor/hls-entry.mjs");
+const vendorDir = path.join(repoRoot, "vendor");
+const outFile = path.join(vendorDir, "hls.bundle.min.js");
+const licenseSrc = path.join(repoRoot, "node_modules/hls.js/LICENSE");
+const licenseOut = path.join(vendorDir, "hls.LICENSE");
+
+await mkdir(vendorDir, { recursive: true });
+
+await build({
+  bundle: true,
+  entryPoints: [entryPoint],
+  outfile: outFile,
+  format: "esm",
+  splitting: false,
+  platform: "browser",
+  target: ["es2020"],
+  minify: true,
+  sourcemap: false,
+  define: {
+    "process.env.NODE_ENV": '"production"',
+    global: "globalThis",
+  },
+  logLevel: "info",
+});
+
+try {
+  await copyFile(licenseSrc, licenseOut);
+} catch (error) {
+  console.warn("[build-hls] could not copy LICENSE:", error.message);
+}
+
+console.log("[build-hls] wrote", path.relative(repoRoot, outFile));

scripts/vendor/hls-entry.mjs

@@ -0,0 +1,6 @@
+// Vendor entry for hls.js. We deliberately bundle the FULL build rather than
+// `hls.js/light`: the light build drops the alternate-audio stream controller,
+// and real-world HLS ladders (e.g. nostube/slidestr publishes an
+// `EXT-X-MEDIA:TYPE=AUDIO` rendition group) demux audio into its own playlist.
+// With the light build those streams play video-only or not at all.
+export { default } from "hls.js";