Floatplane channel plugin for Jellyfin 10.10.x: browse, HLS proxy, cookie session, CI release

- IChannel: creators -> sub-channels -> video posts (public listing API, search mapped)
- IRequiresMediaInfoCallback -> signed proxy URLs; stream controller rewrites HLS so the
  AES-128 key is fetched server-side with the session cookie, segments stay on the CDN
- delivery/info cached per token lifetime and throttled (~2/min)
- config page: paste sails.sid + validate, extra creators, quality, search test
- scripts/package.sh -> plugin folder + zip + md5 + manifest.json; Gitea release workflow
- research docs, HAR analysis (HAR itself gitignored), install-pi5.sh

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

doc/research/reference-sources/README.md

@@ -0,0 +1,18 @@
+# Third-party reference sources (NOT part of the plugin)
+
+Snapshots of files from other open-source Floatplane clients, fetched
+2026-10-25 for study only. Each file keeps its upstream licence; nothing
+here is compiled into or shipped with the plugin.
+
+| Prefix | Project | Why it matters |
+|--------|---------|----------------|
+| `bz_*` | bmlzootown/FloatplaneAPI (API-shape canary, Node) | cleanest device-flow + DPoP + refresh implementation; measured token lifetimes |
+| `fpts_*`, `fpapi_*` | Inrixia/floatplaneAPI.ts (`floatplane` npm) | typed REST wrapper, device login via openid-client, got hooks |
+| `fpdl_*` | Inrixia/floatplane-downloader | delivery `download` scenario, rate-limit semaphore, channel sorting |
+| `hydra_*` | bmlzootown/Hydravion (Roku, BrightScript) | hand-rolled device flow, live-stream polling, Bearer on the video node |
+| `wf_*` | jamamp/Wasserflug-tvOS (Swift) | `DeliveryHelper.getBestUrl`, HLS key loader adding Bearer, progress sync |
+| `floaty_*` | floatyfp/floaty (Flutter) | auth-code+PKCE, rate-limit manager, mpv headers, download URL trick |
+| `fn_*` | coulterpeterson/FloatNative (Kotlin/Swift) | DPoP manager, playlist rewrite (key via auth, segments plain) |
+| `ytdlp_floatplane.py` | yt-dlp extractor | v3 shapes, `#EXT-X-KEY` handling, channel URL resolution |
+| `spec_*`, `oidc.json` | jamamp/FloatplaneAPI OpenAPI spec + live OIDC discovery | request/response schemas |
+| `chaosflix/` | praetorianer777/chaosflix-jellyfin (C#) | **closest prior art**: `IChannel` + `IRequiresMediaInfoCallback` + HMAC-signed proxy controller + sync task + meta.json packaging + CI release workflow |