fix(r5): address the eighth /code-review high round — 7 findings

The worst one was, again, the previous round's own fix.

- Round 7 stopped awaiting the HLS sweep so startup could serve immediately — which
  also made it run CONCURRENTLY with playback, and `sweep_orphans` snapshotted the
  live-session set BEFORE listing the root and rmtree'd outside the lock. Since
  `start_session` reuses a directory path for the same (key, offset, tag), a stale
  name can become a live session at any moment. Two guards now: nothing whose mtime
  is newer than this process's start is ever deleted, and the live check + rmtree
  happen together under the lock, one directory at a time.
- The sweep task is awaited after cancel, so shutdown can't leave it pending.
- `_rate_limiter` used a truthiness test on its timestamp, so a `now()` of exactly
  0.0 read as "never ran" — unreachable in production, but `now` exists to be
  injected and a test clock starting at 0 is the obvious choice.
- The RSS total-outage error now carries the first underlying error: "all N channels
  failed" is also what ONE dead feed id looks like on a small instance, and a red
  card the user can't act on is its own kind of dishonest.
- The WebKit fullscreen handling moved into `lib/fullscreen` and PlexPlayer uses it
  too — it had the same unprefixed-only reads in three places, including an Escape
  branch that would have closed the whole player instead of leaving fullscreen.
- The `--max` CSS comment claimed `inset: 0` did the sizing; Tailwind's `w-full` is
  still on the element and wins. Comment now states the real mechanism.

Verified in real Chrome (the pane can't composite or do native fullscreen):
- F fills the 1920x889 viewport; the exit pill renders top-right on the letterbox
  band and overlaps NO YouTube control — the collision this round suspected does not
  reproduce in this embed (its own buttons sit bottom-left / bottom-right).
- Four real ArrowDown presses while maximised: persisted volume 100 -> 80, with the
  level flash visible on screen.
- A real click on the exit pill un-maximises and returns focus to the card.
- lib/fullscreen driven from a real click: enter (innerHeight 889 -> 1024), the
  change listener fires exactly once per transition, exit returns to 889.

Backend suite 150 -> 158; the new sweep tests are mutation-checked, and they read
their cutoff from the filesystem rather than a clock (the container VM and the
bind-mounted host disagree by enough to make a clock-based assertion flaky).

frontend/src/lib/fullscreen.ts

@@ -0,0 +1,49 @@
+// The browser's Fullscreen API, WebKit included.
+//
+// Safari and iPadOS still ship only the prefixed spelling: no `fullscreenchange`, no
+// `fullscreenElement`, no `requestFullscreen` on a plain element. Reading only the unprefixed names
+// there means the page believes it is NEVER fullscreen — which silently breaks whatever the
+// fullscreen state drives (an overlay that must yield, a focus reclaim, an Esc branch that would
+// otherwise close the whole player instead of just leaving fullscreen).
+//
+// Both video surfaces (PlayerModal's YouTube embed, PlexPlayer's <video>) go through here, so the
+// prefix handling lives in ONE place — the previous shape had it in neither, then in one.
+
+type WebkitDocument = Document & {
+  webkitFullscreenElement?: Element | null;
+  webkitExitFullscreen?: () => void;
+};
+type WebkitElement = HTMLElement & { webkitRequestFullscreen?: () => void };
+
+/** The element currently holding the fullscreen lock, or null. */
+export function fullscreenElement(): Element | null {
+  const d = document as WebkitDocument;
+  return d.fullscreenElement ?? d.webkitFullscreenElement ?? null;
+}
+
+/** Ask for fullscreen on `el`. Errors are swallowed on purpose: a refused request (no user
+ * activation, an iOS device that only fullscreens <video>) is not something a caller can fix. */
+export function requestFullscreen(el: HTMLElement): void {
+  const e = el as WebkitElement;
+  if (e.requestFullscreen) void e.requestFullscreen().catch(() => {});
+  else e.webkitRequestFullscreen?.();
+}
+
+/** Leave fullscreen, whoever holds it. */
+export function exitFullscreen(): void {
+  const d = document as WebkitDocument;
+  if (d.exitFullscreen) void d.exitFullscreen().catch(() => {});
+  else d.webkitExitFullscreen?.();
+}
+
+/** Subscribe to fullscreen transitions; returns the unsubscribe. Registers BOTH spellings — a
+ * browser that supports both never fires both for the same transition, so the handler still runs
+ * once. */
+export function onFullscreenChange(handler: () => void): () => void {
+  document.addEventListener("fullscreenchange", handler);
+  document.addEventListener("webkitfullscreenchange", handler);
+  return () => {
+    document.removeEventListener("fullscreenchange", handler);
+    document.removeEventListener("webkitfullscreenchange", handler);
+  };
+}