feat: broker validated sources and bounded media probing

[jahvari]

Summary

• add a sealed validated-media-source broker for completed files, engine loopback streams, approved remote sources, and synthetic fixtures
• add bounded typed FFprobe JSON parsing for H.264, HEVC, AV1, VP9, MPEG-2, VC-1, HDR/color metadata, exact rates, and selected-stream identity
• integrate typed probing observationally with HLS while preserving the existing public response contract and legacy casting behavior

Release notes

• Playback inputs used by the transcoding subsystem are now validated, capability-scoped, bounded, and secret-safe.
• Media inspection now uses bounded typed FFprobe JSON with detailed H.264, H.265/HEVC, AV1, HDR, color, frame-rate, and stream-selection metadata.
• This is a security and runtime foundation change. It does not yet enable GPU transcoding, alter the public HLS response contract, or migrate casting to the new pipeline.
• No end-user settings or migration steps are required.

Security and reliability

• use expiring, revocable 256-bit source capabilities with constant-time verification and fixed loopback-only routing
• enforce canonical/native completed-file identity, bounded Range handling, request admission, backpressure, and secret-safe logging
• reuse the existing SSRF resolver, redirect validation, DNS pinning, and proxy runtime for approved remote sources
• supervise FFprobe with bounded stdout/stderr, inactivity/starvation/overall deadlines, cancellation, and confirmed process reaping
• bound parser shape, cache size, entry count, in-flight work, and cache-key cardinality

Compatibility boundary

This is hardware-transcoding plan Tasks 7 and 8. It provides trusted inputs and typed media metadata, but does not yet select or execute GPU devices. HLS typed probing is observational and its legacy response shape remains unchanged. Remote casting remains on the existing path until its later planned migration.

Verification

• server librqbit matrix: 468 library tests plus all integration suites and doctests passed; zero failures
• EngineFS librqbit matrix: 66 tests passed; zero failures
• strict Clippy passed for server and EngineFS with warnings denied
• cargo fmt check and git diff check passed
• dependency audit reported no denied vulnerability
• changed-file credential, private-key, token, username, and local-path scan found no matches
• fork PR checks and the post-merge master workflow passed the Linux default-libtorrent/librqbit and Windows native-FFI/shutdown matrices