Fix Apple episode-transition media auth

[blurbery]

What I changed

I added a narrowly scoped server compatibility path for Apple build 31 across iOS, iPadOS, macOS and tvOS. It keeps header_authenticated_media_v1 intact and supplies the existing signed, session-bound media capability in a plan header.

The Apple client and AetherEngine use the same playback boundary across those platforms. The client resolves the current API bearer when an item starts, then AetherEngine snapshots LoadOptions.httpHeaders and reuses them for later range reads and internal reloads. If that bearer expires during playback, normal API calls refresh successfully but the media loader can keep sending the old bearer. That produces 401 range responses while already buffered playback continues, which appears as a loading badge and can affect automatic episode transitions.

The server now validates the narrower session capability before falling back to the bearer. The media URL remains credential-free, the Apple client continues to see a consistent header-authenticated contract, and the capability is bound to the user, profile, media file, play method and playback session.

This keeps the playback decision and media bytes unchanged. A direct DV7 MKV remains the same direct DV7 MKV, and the selected audio route is unchanged. It does not force HLS, remuxing, transcoding, HDR conversion or a quality downgrade.

Scope

The compatibility path only applies when all of these match:

• Apple platform reported as iOS, tvOS or macOS
• app build 31
• header_authenticated_media_v1 and device_quirks_v1 are both advertised

The path keeps media on the authenticated API origin. Later builds and non-Apple clients retain the existing behavior.

Validation

• Added direct-plan coverage proving Apple build 31 receives a signed session capability in the plan header with no credential in the URL
• Verified the capability claims are bound to the returned session and media file
• Added boundary coverage for iOS, tvOS, macOS, build 32, Android and clients without device quirks
• Verified ordinary header-authenticated and legacy URL modes remain unchanged
• Verified query and header capabilities both authenticate before an expired bearer for GET and HEAD requests
• Ran the complete handler, middleware and stream-token package test suites
• Ran git diff --check

[blurbery]

Linked Apple renderer follow-up: blurbery/silo-apple#8

The deployed server fix keeps long-running Apple media requests authorized. The linked Apple change handles the separate episode-to-episode display and Aether lifecycle handoff that the live E3 to E4 test exposed.