refactor(player): delete the webview video path; mpv selects its own tracks

DR-235 phase 3. Every video renderer is native now: mpv on Linux and
Windows, ExoPlayer on Android, all drawing behind the transparent
webview. The HTML5 <video> path is gone, not bypassed:

- Frontend: hls.js, Html5PlayerAdapter and its compatibility shim, the
  createAdapter factory, streamTransport, hlsRecovery, timeTracking,
  videoFit, the <video>/<track> markup and every element handler in
  VideoPlayer (3277 -> 2144 lines), the experimentalNativeVideo store
  and its Settings toggle, webviewVideoFallback/supportsNativeVideo, and
  the setHtml5VideoState PiP bridge call. NativePlayerAdapter is the one
  video adapter; webview audio gets its own adapter kind.
- Rust: use_html5 dropped from player_seek_video,
  player_switch_audio_track and player_set_stream_quality with the
  Html5* strategies and ReloadStream responses; use_html5_element and
  VideoBackend dropped from PlayerStatus; player_play_item always loads
  the backend (set_current_item removed); Capabilities::webview removed;
  the WebKitGTK GStreamer/VAAPI setup (and its gst-inspect spawn) removed.
- Android: the HTML5 video state in PictureInPictureManager and
  ScreenWakeManager, and the bridge method feeding it.
- CSP: connect-src loses http:/https: and worker-src loses blob: -
  both existed for hls.js; with it gone they were only an exfiltration
  channel and a blob worker for injected script. A test now keeps them
  out.

mpv takes over what the <video> element did (mpv_tracks, UT-275):
subtitles are the WebVTT list the play request carries, queued on
sub-files and selected by position in that list, starting off; audio
tracks are selected by position in the file; sid/aid are reset before
each load. Without this, Linux video had no subtitle selection and a
direct-play audio switch failed since mpv became its renderer.

Verified: Rust 948 passing, and the same 948 cross-compiled for Windows
under wine against the shipped DLL (track tests included); frontend
1111 passing; aarch64 debug APK builds. Lint warnings 158 -> 146, CI
ratchet tightened to match. Not yet seen on Windows hardware.

docs/specs/desktop-native-video.md

@@ -1,17 +1,17 @@
 # Spec: Desktop native video — mpv renders the picture, everywhere
 
-**Status:** Partially implemented — phase 1 routing shipped: mpv is the only
-Linux video renderer (`native_video::enabled()` is unconditional on Linux, no
-webview fallback is offered). **Left:** Linux's device profile still claims only
-`h264` (DR-234), so video still arrives as a server transcode — mpv plays it, but
-the direct-play gain is not yet taken; `hwdec` is unset, so mpv decodes in
-software (DR-236); a failed surface attach only logs, it does not surface an
-error; the phase 1 soak and X11/Wayland criteria are unrecorded; phases 2 and 3.
-Phase 2 has started from its build half: Windows now links and ships libmpv
-(for audio, see windows-native-audio-backend.md); its video surface is not
-written. Phase 3 also deletes the now-inert frontend switch (`experimentalNativeVideo`,
-`nativeVideoWanted`, the Settings toggle and the adapter's suppressor flag),
-which no platform reaches since `webview_video_fallback` became false everywhere.
+**Status:** Partially implemented — all three phases' *code* has shipped: mpv
+is the only video renderer on Linux (render API into the GTK vbox) and Windows
+(`wid` into the app window, `vo=gpu-next,gpu`), and the webview video path is
+deleted — hls.js, the HTML5 adapter, the `<video>` element, the frontend switch,
+the `use_html5` command parameters and the Android HTML5 PiP/screen-wake state
+(DR-235). mpv selects subtitles and audio tracks itself (`mpv_tracks`).
+**Left:** Linux/Windows still claim only `h264` (DR-234), so video is still a
+server transcode — mpv plays it, but the direct-play gain is not taken; `hwdec`
+is unset, so mpv decodes in software (DR-236); a failed surface attach only
+logs; and every hardware criterion is unrecorded — the X11/Wayland check and
+soak on Linux, and **any** run of Windows video, which has only been verified by
+unit tests under wine (options accepted by the shipped DLL), never on screen.
 **Requirements:** UR-080 (new) → DR-231 … DR-237 (new); IR-033 (new)
 **UX spec:** n/a — nothing about the player's appearance changes. What changes is
 what is behind the controls.