fix(r5): address the seventh /code-review high round — 7 findings

Five of them sit where round 6 turned F from a Fullscreen API call into a CSS
maximise: the guards around it still asked `isFullscreen`, which that pivot made
permanently false.

- Arrow-key volume was dead in the maximised view: the scroll-deference checked
  only `isFullscreenRef`, so the (now hidden but still scrollable) card kept
  swallowing Up/Down. Both flags now count as "the video fills the screen".
  Measured: 87px of scroll room on the focused card, ArrowDown moves 80 -> 75
  and scrolls nothing.
- The maximised view had no way out once the pointer touched the video. Reaching
  YouTube's controls means clicking into the cross-origin iframe, which takes
  keyboard focus with it, and the re-arm paths (stage mouseleave, window focus)
  need the pointer to leave the browser entirely while the stage fills it. So
  the exit now lives on screen, in our DOM: a button that un-maximises AND pulls
  focus back, re-arming every shortcut.
- WebKit fires only `webkitfullscreenchange`/`webkitFullscreenElement`, so on
  Safari/iPadOS YouTube's own fullscreen never registered — no overlay yield, no
  focus reclaim. One `fullscreenEl()` reader, both event spellings.
- The stage claimed `z-index: 9999`, the glass tuner's reserved level, for a job
  that only needs to beat the modal chrome it is nested in (its siblings top out
  at z-menu). Dropped to rail-level; nothing escapes the modal's stacking
  context either way.
- `inset: 0` already sizes a fixed layer — the inherited `100vw`/`100vh`
  over-constrained it, which is how a classic scrollbar gets a horizontal
  overflow and a mobile URL bar hides the bottom edge (YouTube's control bar).
- The shortcut hint still promised "F: fullscreen" in both locales.

Backend, both "the fix stopped one layer short":
- The startup HLS sweep was awaited inside lifespan, so uvicorn still served
  nothing until it finished — a thread doesn't help when nothing is listening
  yet. Fire-and-forget task instead, cancelled on shutdown. Measured with 200
  planted segments: "Application startup complete" now precedes "swept 1".
- An RSS poll where every channel failed returned normally, so the scheduler
  recorded `ok` with the outage buried in the summary string. `failed == total`
  now raises: a run that reached nothing is a failed run.

Suites: backend 147 -> 150.

frontend/src/index.css

@@ -586,16 +586,29 @@ html[data-scheme="matrix"][data-theme="light"] {
    fullscreen button stops working (see PlayerModal.toggleFullscreen). */
 .player-stage:fullscreen,
 .player-stage--max {
-  width: 100vw;
-  height: 100vh;
   aspect-ratio: auto;
   border-radius: 0;
 }
 
+/* A fullscreened element is already sized by the browser; the viewport units are only for the
+   `:fullscreen` path, where the stage is not positioned. */
+.player-stage:fullscreen {
+  width: 100vw;
+  height: 100vh;
+}
+
+/* `inset: 0` alone does the sizing here — adding width/height would over-constrain the box (left +
+   width win, right/bottom are ignored), which is how `100vw` sneaks a horizontal overflow in next
+   to a classic scrollbar and `100vh` pushes the bottom edge — YouTube's own control bar — under a
+   mobile browser's chrome. */
 .player-stage--max {
   position: fixed;
   inset: 0;
-  z-index: 9999; /* the tuner level — above the modal chrome it is nested in */
+  /* rail-level (40): this stage only has to beat the modal chrome it is nested inside (whose own
+     children top out at z-menu/20). The modal root is a z-overlay stacking context, so nothing
+     here escapes it — 9999 is the glass tuner's reserved level and claimed an authority this
+     layer neither has nor needs. */
+  z-index: 40;
 }
 
 /* Thin, theme-aware scrollbars */