fix(player): give every transcode its own play session, and stop the one it replaces

Switching bitrate mid-film stalled playback. The server served the new
playlist and then rejected its segments: 400 on hls1/main/0.ts, six times
over 25 seconds, never recovering, while the UI logged "Streaming quality
changed" as if nothing were wrong.

Jellyfin keys a transcode job by device and play session. Every stream URL
this app built carried the same hardcoded DeviceId and no PlaySessionId at
all, so the second stream for an item was indistinguishable from the first
and nothing ever stopped the old ffmpeg. Re-opening a stream is not rare —
a quality switch, a transcoded seek and an audio-track switch all do it.
Replayed against the server, a second stream opened for a live job's item
alternates per attempt between serving bytes and 400ing, which is why it
read as flaky rather than broken.

begin_video_play_session mints a session id per open and reports the one it
supersedes; the URL builder stops that job (DELETE /Videos/ActiveEncodings,
un-retried — a slow stop must not delay playback) before returning. Putting
it in the builder rather than in each caller covers every re-open path by
construction. adopt_video_play_session takes ownership of the job the server
starts itself when PlaybackInfo answers with a TranscodingUrl: without it the
first switch on a stream has nothing to stop and collides with what is
playing.

Two client faults made the same incident worse and go with it:

- The fatal-HLS-error handler added the transcode seek offset to a position
  that already included it. Past roughly the halfway mark of a film the
  doubled value cleared the "near end" threshold, so any transient network
  error was reported as end-of-stream and autoplay skipped to the next item
  — precisely when a quality switch had just made the offset large. The
  decision now lives in hlsRecovery.ts, against the absolute position.
- The HTML5 reload primitive resolved on its own canplay timeout, so a
  reload the server never served reported success. The picker showed a
  quality that was not playing and the caller had nothing to revert.

TRACES: UR-074, UR-004 | DR-177 | UT-173, UT-174, UT-175

src/lib/components/player/hlsRecovery.test.ts

@@ -0,0 +1,64 @@
+import { describe, it, expect } from "vitest";
+import { fatalNetworkErrorAction } from "./hlsRecovery";
+
+/**
+ * A fatal hls.js network error mid-film must be retried, not reported as the
+ * end of the stream — reporting "ended" hands control to autoplay and skips to
+ * the next item while the user is still watching this one.
+ *
+ * The position the player displays is *already absolute*: the RAF loop sets
+ * `currentTime = seekOffset + element.currentTime`. Anything that adds the
+ * offset a second time doubles the apparent position, and after a quality
+ * switch or a transcoded seek the offset is the whole resume position — so past
+ * roughly the halfway mark the doubled value clears the near-end threshold and
+ * every transient error is misread as the end.
+ *
+ * TRACES: UR-004, UR-074 | DR-177 | UT-174
+ */
+describe("fatalNetworkErrorAction", () => {
+  it("retries a mid-film failure after a quality switch instead of ending playback", () => {
+    // 90-minute film, quality switched at the 50-minute mark: the reloaded
+    // stream's timeline starts at 0, so seekOffset carries the 50 minutes and
+    // the displayed position — already absolute — is 3000s of 5400s, 56%
+    // through and nowhere near the end.
+    const action = fatalNetworkErrorAction({
+      positionSeconds: 3000,
+      knownDurationSeconds: 5400,
+      attempts: 1,
+    });
+
+    expect(action).toBe("retry");
+  });
+
+  it("treats a failure in the last tenth of the stream as the end", () => {
+    // Jellyfin's transcoded HLS does not always emit #EXT-X-ENDLIST, so a
+    // genuine end-of-stream arrives as a fatal network error.
+    const action = fatalNetworkErrorAction({
+      positionSeconds: 5300,
+      knownDurationSeconds: 5400,
+      attempts: 1,
+    });
+
+    expect(action).toBe("ended");
+  });
+
+  it("stops retrying once the recovery budget is spent", () => {
+    const action = fatalNetworkErrorAction({
+      positionSeconds: 60,
+      knownDurationSeconds: 5400,
+      attempts: 4,
+    });
+
+    expect(action).toBe("giveUp");
+  });
+
+  it("retries when the runtime is not known yet", () => {
+    const action = fatalNetworkErrorAction({
+      positionSeconds: 120,
+      knownDurationSeconds: 0,
+      attempts: 1,
+    });
+
+    expect(action).toBe("retry");
+  });
+});