fix(r5): address the eighth /code-review high round — 7 findings

The worst one was, again, the previous round's own fix.

- Round 7 stopped awaiting the HLS sweep so startup could serve immediately — which
  also made it run CONCURRENTLY with playback, and `sweep_orphans` snapshotted the
  live-session set BEFORE listing the root and rmtree'd outside the lock. Since
  `start_session` reuses a directory path for the same (key, offset, tag), a stale
  name can become a live session at any moment. Two guards now: nothing whose mtime
  is newer than this process's start is ever deleted, and the live check + rmtree
  happen together under the lock, one directory at a time.
- The sweep task is awaited after cancel, so shutdown can't leave it pending.
- `_rate_limiter` used a truthiness test on its timestamp, so a `now()` of exactly
  0.0 read as "never ran" — unreachable in production, but `now` exists to be
  injected and a test clock starting at 0 is the obvious choice.
- The RSS total-outage error now carries the first underlying error: "all N channels
  failed" is also what ONE dead feed id looks like on a small instance, and a red
  card the user can't act on is its own kind of dishonest.
- The WebKit fullscreen handling moved into `lib/fullscreen` and PlexPlayer uses it
  too — it had the same unprefixed-only reads in three places, including an Escape
  branch that would have closed the whole player instead of leaving fullscreen.
- The `--max` CSS comment claimed `inset: 0` did the sizing; Tailwind's `w-full` is
  still on the element and wins. Comment now states the real mechanism.

Verified in real Chrome (the pane can't composite or do native fullscreen):
- F fills the 1920x889 viewport; the exit pill renders top-right on the letterbox
  band and overlaps NO YouTube control — the collision this round suspected does not
  reproduce in this embed (its own buttons sit bottom-left / bottom-right).
- Four real ArrowDown presses while maximised: persisted volume 100 -> 80, with the
  level flash visible on screen.
- A real click on the exit pill un-maximises and returns focus to the card.
- lib/fullscreen driven from a real click: enter (innerHeight 889 -> 1024), the
  change listener fires exactly once per transition, exit returns to 889.

Backend suite 150 -> 158; the new sweep tests are mutation-checked, and they read
their cutoff from the filesystem rather than a clock (the container VM and the
bind-mounted host disagree by enough to make a clock-based assertion flaky).

frontend/src/index.css

@@ -597,10 +597,13 @@ html[data-scheme="matrix"][data-theme="light"] {
   height: 100vh;
 }
 
-/* `inset: 0` alone does the sizing here — adding width/height would over-constrain the box (left +
-   width win, right/bottom are ignored), which is how `100vw` sneaks a horizontal overflow in next
-   to a classic scrollbar and `100vh` pushes the bottom edge — YouTube's own control bar — under a
-   mobile browser's chrome. */
+/* Sizing, precisely: the element keeps Tailwind's `w-full` from its base className, so the WIDTH is
+   `100%` of the containing block — which, for a fixed element, is the viewport minus any classic
+   scrollbar. The HEIGHT comes from `inset: 0` (top+bottom, once `aspect-ratio` is released above).
+   `right: 0` is therefore ignored (over-constrained: left + width win) — harmless, but don't read
+   this rule as inset-sized. What had to go are the viewport units it used to inherit: `100vw`
+   INCLUDES the scrollbar (horizontal overflow) and `100vh` includes a mobile browser's retracting
+   chrome, which pushes the bottom edge — YouTube's own control bar — off screen. */
 .player-stage--max {
   position: fixed;
   inset: 0;