feat: add protected transcoding device capability registry

[jahvari]

Summary

• add bounded Windows DXCore/DXGI/PnP and Linux DRM/sysfs transcoding-device discovery
• model macOS VideoToolbox as an administratively disabled logical device until packaging support exists
• derive stable opaque per-install device IDs while keeping locators, driver material, runtime digests, and source identities private
• inventory the exact paired Jellyfin FFmpeg runtime through six bounded, listing-only, supervised commands
• add exact H.264, HEVC/H.265, and AV1 capability keys, immutable evidence state, bounded verification admission, protected persistence, and atomic refresh
• expose a redacted loopback-only capability inventory and token-authenticated manual refresh endpoint
• wire startup and shutdown so registry work drains before process-supervisor cancellation
• extend Linux, Windows, and non-packaging macOS qualification coverage

Security and compatibility

• production verification remains observational: UnknownVerifier launches no runtime command or child process
• no playback path selects a GPU in this PR; legacy HLS, casting, /device-info, and /hwaccel-profiler behavior remains unchanged
• API trust uses the actual socket peer, strict local authority/origin parsing without DNS, settings-token authorization before body/work, bounded JSON construction, fixed isolation headers, and no CORS
• device seed/evidence files use protected native storage, bounded strict schemas, atomic replacement, lifetime locking, and joined shutdown
• public-safety scans found no local username/path, credential/private key, installed-runtime data, raw device identity, binary, log, or build output

Release notes

Adds the protected hardware-device and codec-capability inventory foundation for future hardware-accelerated HLS and casting. This release does not yet route playback through the GPU and does not add user-facing hardware settings.

Verification

• 28 fake-media-tool tests passed
• 219 focused device/inventory/registry/API/compatibility tests passed; five focused helper/debt cases intentionally ignored
• 636 server library tests passed; five helper subprocess cases intentionally ignored
• 787 combined enginefs/server/integration/doctests passed; ten intentional ignores
• warnings-as-errors Clippy passed for enginefs and server across all librqbit targets
• formatting, diff hygiene, workflow authority, public-safety, and final zero-finding audit passed

Exact head: 4cde60b0cc50ad666813a2c5cf28d5ac3cdd68cc

Follow-up

Hardware recipe qualification, persistent HLS/casting sessions, device preferences, telemetry, and actual GPU execution remain separate later PRs.