fix(e4): address code-review findings (a11y sweep + dedup guards)

Resolves the 5 /code-review high findings on this branch:
- a11y sweep: extend aria-label to the remaining icon-only Plex card buttons the
  first pass missed — PlexPosterCard Info, SeasonCard watched-toggle + add-season
  (EpisodeCard already had them). "Fix a principle everywhere, in one sweep."
- new shared lib/parseId.ts `parsePositiveIntId`, used by BOTH readSelectedId
  (now guarding the stored ?pl fallback the same as the URL — was unguarded) and
  plexSubUrl's ?v=playlist decode; removes the hand-duplicated guard.
- PAGE_KEY exported from navigationInit and imported by NavigationProvider (was
  defined in both).
- hoist a `watchedLabel` const per card so title + aria-label can't drift.

+8 tests (parseId unit + guarded-stored ?pl); full FE gate green (tsc/eslint/
prettier/knip, 317 vitest).

frontend/src/components/playlistsInit.test.ts

@@ -48,6 +48,14 @@ describe("readSelectedId ?pl guard", () => {
     expect(readSelectedId()).toBe(9);
   });
 
+  it.each(["", "0", "-2", "1.5", "abc"])(
+    "rejects a non-positive-integer STORED value %s (guarded like the URL)",
+    (raw) => {
+      stored.v = raw;
+      expect(readSelectedId()).toBeNull();
+    },
+  );
+
   it("returns null when neither ?pl nor a stored selection is present", () => {
     expect(readSelectedId()).toBeNull();
   });