refactor(player): delete the webview video path; mpv selects its own tracks

DR-235 phase 3. Every video renderer is native now: mpv on Linux and
Windows, ExoPlayer on Android, all drawing behind the transparent
webview. The HTML5 <video> path is gone, not bypassed:

- Frontend: hls.js, Html5PlayerAdapter and its compatibility shim, the
  createAdapter factory, streamTransport, hlsRecovery, timeTracking,
  videoFit, the <video>/<track> markup and every element handler in
  VideoPlayer (3277 -> 2144 lines), the experimentalNativeVideo store
  and its Settings toggle, webviewVideoFallback/supportsNativeVideo, and
  the setHtml5VideoState PiP bridge call. NativePlayerAdapter is the one
  video adapter; webview audio gets its own adapter kind.
- Rust: use_html5 dropped from player_seek_video,
  player_switch_audio_track and player_set_stream_quality with the
  Html5* strategies and ReloadStream responses; use_html5_element and
  VideoBackend dropped from PlayerStatus; player_play_item always loads
  the backend (set_current_item removed); Capabilities::webview removed;
  the WebKitGTK GStreamer/VAAPI setup (and its gst-inspect spawn) removed.
- Android: the HTML5 video state in PictureInPictureManager and
  ScreenWakeManager, and the bridge method feeding it.
- CSP: connect-src loses http:/https: and worker-src loses blob: -
  both existed for hls.js; with it gone they were only an exfiltration
  channel and a blob worker for injected script. A test now keeps them
  out.

mpv takes over what the <video> element did (mpv_tracks, UT-275):
subtitles are the WebVTT list the play request carries, queued on
sub-files and selected by position in that list, starting off; audio
tracks are selected by position in the file; sid/aid are reset before
each load. Without this, Linux video had no subtitle selection and a
direct-play audio switch failed since mpv became its renderer.

Verified: Rust 948 passing, and the same 948 cross-compiled for Windows
under wine against the shipped DLL (track tests included); frontend
1111 passing; aarch64 debug APK builds. Lint warnings 158 -> 146, CI
ratchet tightened to match. Not yet seen on Windows hardware.

src/lib/utils/pictureInPicture.ts

@@ -22,7 +22,6 @@ interface AndroidPictureInPictureBridge {
   isSupported(): boolean;
   canEnterPip(): boolean;
   setAutoEnterEnabled(enabled: boolean): void;
-  setHtml5VideoState(active: boolean, width: number, height: number, playing: boolean): void;
 }
 
 declare global {
@@ -89,36 +88,3 @@ export function setAutoEnterEnabled(enabled: boolean): void {
     log.warn("Failed to set auto-enter:", err);
   }
 }
-
-/**
- * Tell native that a WebView `<video>` is (or is no longer) the playback surface.
- *
- * This is what makes PiP work on the HTML5 path. The native side only ever knew
- * about the ExoPlayer surface, and that path is behind `experimentalNativeVideo`,
- * which defaulted to off when this was written — so `canEnterPip` was always
- * false and pressing the button did nothing. Reporting the element's state gives
- * native a surface it can legitimately shrink into, plus the intrinsic size it
- * needs for the PiP window's aspect ratio and the play state for its play/pause
- * action.
- *
- * The flag is back to defaulting **off** (DR-172, after native video shipped as
- * audio with no picture), so this is once again the path Android normally takes —
- * which is why PiP does not depend on that flag being on.
- *
- * Pass `active: false` when the element goes away, or PiP would be offered over a
- * video that is no longer there.
- *
- * TRACES: UR-041 | DR-160
- */
-export function setHtml5VideoState(
-  active: boolean,
-  width: number,
-  height: number,
-  playing: boolean,
-): void {
-  try {
-    bridge()?.setHtml5VideoState(active, Math.round(width), Math.round(height), playing);
-  } catch (err) {
-    log.warn("Failed to report HTML5 video state:", err);
-  }
-}

src/lib/utils/videoSurface.ts

@@ -55,8 +55,7 @@ function bridge(): AndroidVideoSurfaceBridge | undefined {
 /**
  * Whether the native-surface bridge exists on this platform. This reports only
  * that the *plumbing* is present; whether native video should actually be used
- * is Rust's decision (`player_get_capabilities`) gated by the user's
- * `experimentalNativeVideo` flag.
+ * is Rust's decision.
  */
 export function isNativeSurfaceBridgeAvailable(): boolean {
   try {