fix: route HLS video streams through /stream/hls proxy (#51)

[ravirajsinh45]

Summary

Fixes #51. The /stream/hls/{path} proxy router was already built, tested, and registered in main.py — it just wasn't wired up. The three stream endpoints (get_stream_url, validate_share_link, get_share_stream_url) all handed out a direct presigned URL to master.m3u8, which forced the HLS player to fetch variant playlists and .ts segments as unsigned requests. That only works on buckets with public-read, which non-AWS providers (Exoscale SOS, Cloudflare R2, etc.) don't grant by default to new objects — hence the 403s in the reporter's setup.

• Each stream endpoint now mints a short-lived HLS JWT scoped to MediaFile.s3_key_processed and returns /stream/hls/master.m3u8?token=…
• The proxy rewrites variant .m3u8 references to stay inside the proxy (same token) and rewrites .ts references to freshly-presigned S3 URLs
• Bucket can stay fully private on every S3-compatible provider — no ACL, no public bucket policy
• Captured URLs expire in 24h instead of living forever via public-read
• Zero frontend changes — video-player.tsx already resolved relative /stream/hls/… paths
• Bumped HLS token + segment presign TTLs from 4h → 24h so pause-and-resume works without refresh logic

Security model

	Before	After
Bucket ACL	Had to be public-read	Fully private
master.m3u8 access	Indefinite presigned S3 link	Token-scoped via API (24h)
Captured .ts URL lifetime	Forever	≤24h
Works on Exoscale/R2/MinIO/AWS	No (non-AWS 403)	Yes, identical on all

Segments still stream directly from S3 via presigned URLs (industry standard, matches Frame.io / Vimeo). Full tunneling through the API would cost 2x egress and add Range-request complexity — deferred as a follow-up if a specific threat model needs it.

Test plan

• New test_assets_stream_url.py — video returns /stream/hls/…?token=… with a valid HLS JWT scoped to s3_key_processed; download=true still returns a presigned raw URL; image/audio paths still presigned
• Updated test_share_video_stream.py — the share/{token} endpoint returns folder path instead of master.m3u8 for video stream URLs #45 regression test now expects the proxy URL, plus a new test for /share/{token}/stream/{asset_id}
• Updated test_hls_proxy.py — segment presign expectation bumped to 86400s
• Full backend suite: 58 passed, 1 warning
• Browser end-to-end via chrome-devtools-mcp against MinIO: /assets/{id}/stream → /stream/hls/master.m3u8?token=… → /stream/hls/0/playlist.m3u8?token=… → 14 presigned .ts segment requests, all 200, video readyState: 4, buffered 0 → 38.94s, zero console errors

🤖 Generated with Claude Code