Authenticate browser media with durable HttpOnly login cookies

Adapted cookie, origin, URL validation and secret handling from MikaelKW/nodecast-tv-plus. Protect API roles, revoke logins across restart, preserve existing accounts, and isolate transcode sessions by account.

Co-authored-by: Mikael <mikaelkwessel@gmail.com>

test/remux.test.js

@@ -1,3 +1,5 @@
+// Synthetic HTTP fixtures explicitly opt in to loopback media.
+process.env.ALLOW_LOCAL_MEDIA_URLS = 'true';
 const test = require('node:test');
 const assert = require('node:assert/strict');
 const fs = require('node:fs');