Floatplane channel plugin for Jellyfin 10.10.x: browse, HLS proxy, cookie session, CI release

- IChannel: creators -> sub-channels -> video posts (public listing API, search mapped)
- IRequiresMediaInfoCallback -> signed proxy URLs; stream controller rewrites HLS so the
  AES-128 key is fetched server-side with the session cookie, segments stay on the CDN
- delivery/info cached per token lifetime and throttled (~2/min)
- config page: paste sails.sid + validate, extra creators, quality, search test
- scripts/package.sh -> plugin folder + zip + md5 + manifest.json; Gitea release workflow
- research docs, HAR analysis (HAR itself gitignored), install-pi5.sh

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

doc/research/reference-sources/bz_refresh-lifetime-evidence.json

@@ -0,0 +1,39 @@
+{
+  "schemaVersion": 1,
+  "capturedAt": "2026-10-11T22:50:18.819Z",
+  "toolId": "fp-api-shape-canary",
+  "toolVersion": "3.1.0",
+  "clientId": "fp-tv-app",
+  "requestedScope": "openid offline_access",
+  "grantedScope": "openid profile email offline_access",
+  "dpopRequired": true,
+  "method": "device-login then grant_type=refresh_token with DPoP (4 then 3 successive refreshes)",
+  "lifetimes": {
+    "expires_in_seconds": 1800,
+    "refresh_expires_in_seconds": 7776000,
+    "refresh_expires_in_days": 90
+  },
+  "rotation": {
+    "refreshTokenRotatedEveryRefresh": true
+  },
+  "wallClock": {
+    "sliding": true,
+    "note": "Each refresh returned full refresh_expires_in=7776000 from that moment; refreshExpiresAt advanced with each refresh."
+  },
+  "responseKeysObservedOnRefresh": [
+    "access_token",
+    "expires_in",
+    "id_token",
+    "not-before-policy",
+    "refresh_expires_in",
+    "refresh_token",
+    "scope",
+    "session_state",
+    "token_type"
+  ],
+  "conclusion": {
+    "indefiniteRollingRefresh": "YES",
+    "caveat": "YES means sliding 90-day offline window: keep refreshing (and retaining DPoP keys) before the window elapses. Missing the window, revoked offline session, or lost DPoP material requires device re-login. Not immortal without activity."
+  },
+  "publicRealmDocNote": "GET /realms/floatplane does not publish ssoSessionMaxLifespan / offlineSessionMaxLifespan; lifetimes taken from token endpoint responses only."
+}