fix(auth): honor JWT media playback contract

[Serph91P]

Summary

• preserve the reviewed JWT/legacy library and keepalive contract
• let interactive JWT and legacy-session identities reach authenticated thumbnails, streams, chapters, share-token generation, and filename streaming without accepting API-key-only access
• normalize VTT chapter responses to numeric id/title/start/end values used by the player service contract
• load the active VideoPlayer auto-chapter path through videoApi.getChapters() and retain legacy prop/WebVTT handling
• include the verified dependency-only fast-uri 3.1.8 and PyJWT/oauthlib audit remediations from PR fix(frontend): add system back navigation #876

Verification

• uv run --locked --group test pytest -q (605 passed, 6 skipped)
• focused JWT/media, range, and dependency compatibility contracts (28 passed)
• frontend unit suite (204 passed, 4 skipped), including the real VideoPlayer chapter adapter/service test
• production build, build-output, precache-integrity, and output-budget checks
• npx playwright test tests/e2e/ux06-player.spec.ts (18 passed, 2 skipped)

Historical review 273 approved only the earlier narrow library/keepalive commit 7c7400c; it does not approve this expanded media-auth and active-player head. This PR remains a draft pending exact-head CI and a new same-card review. No merge, release, deployment, production, or public-instance action was performed.