fix(remux): preserve encrypted HLS and test protocol restrictions

Allow nested crypto for encrypted HTTP HLS while rejecting top-level protocol wrappers and local-file access. Replace the HLS-only http_persistent option with HTTP multiple_requests across probe/remux/transcode paths, fixing the raw HTTP regression introduced by #124. Add real FFmpeg regression tests and PR CI.

server/services/transcodeSession.js

@@ -198,7 +198,7 @@ class TranscodeSession extends EventEmitter {
             '-analyzeduration', '5000000',
             '-fflags', '+genpts+discardcorrupt',
             '-err_detect', 'ignore_err',
-            '-http_persistent', '0',
+            '-multiple_requests', '0',
             '-reconnect', '1',
             '-reconnect_streamed', '1',
             '-reconnect_on_http_error', '4xx,5xx',