feat: production-grade video player — ambient mode, speed controls, hls.js, double-tap, settings flyout

- Ambient canvas (32×18, ~8fps rAF, blur(55px)) behind video; toggleable, persisted
  - Speed controls 0.5×–2× via settings flyout; capRate replaces lockRate, anti-cheat
  preserved
  - hls.js dynamic import for .m3u8 URLs; Safari native HLS fallback; MP4 unchanged
  - Double-tap left=seek back 10s, right=blocked; single-tap toggles play on touch
  - Keyboard: Space/K play-pause, J/← back, L/→ blocked, ↑↓ volume, M mute, F fullscreen
  - Settings flyout with speed picker + ambient toggle (animated, framer-motion)
  - Theater mode toggle, fullscreen API, volume slider with localStorage persistence
  - Buffer visualization behind progress bar, hover timestamp tooltip, playhead thumb
  - All anti-cheat intact: maxTrustedPosRef, PiP block, visibility pause, heartbeat system

frontend/package-lock.json

@@ -27,6 +27,7 @@
         "dompurify": "^3.4.17",
         "emoji-datasource-apple": "^15.1.2",
         "framer-motion": "^12.0.0",
+        "hls.js": "^1.7.3",
         "lucide-react": "^0.468.0",
         "marked": "^18.1.1",
         "next": "15.5.27",
@@ -2493,6 +2494,12 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/hls.js": {
+      "version": "1.7.3",
+      "resolved": "https://registry.npmjs.org/hls.js/-/hls.js-1.7.3.tgz",
+      "integrity": "sha512-MsPlx6yVW4Qv4C7mEVou4/gk/5cN2dVxOTnrNjPSmyH2f0Ln+/UkG10Ax1PE6OvrmTVPKgQYozTtBaPOuCzq7A==",
+      "license": "Apache-2.0"
+    },
     "node_modules/jiti": {
       "version": "2.7.0",
       "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",