feat: replace mpv with hls.js HTML5 video player (v0.4.0)

- Remove mpvController.ts and hlsTrimmer.ts entirely
  - Rewrite PlaybackService: streamlink --stream-url → HLS-URL → IPC event playback:hls-url
  - Add VideoPlayer.tsx (hls.js <video> wrapper, forwardRef with seek/seekTo/pause/play/stop/getCurrentTime)
  - Integrate VideoPlayer into ChannelScreen with direct videoRef calls (no IPC roundtrip for seek/pause)
  - Add global AppShell playback overlay for direct stream start (A-button in Browse/Category/StreamList)
  - Propagate onStartLive callback through BrowseScreen, CategoryScreen, StreamListScreen
  - Add CORS bypass for Twitch CDN (webRequest.onBeforeSendHeaders) and autoplay-policy switch
  - Update CSP: add media-src 'self' blob: for hls.js MediaSource API
  - Open chapter panel without stopping playback (pause + resume instead of stop/restart)
  - Drop IPC channels: seek, seekTo, resume, togglePause, getCurrentPosition, onTimeUpdate
  - Add IPC channel: playback:hls-url event with HlsUrlPayload

src/main/index.ts

@@ -1,4 +1,4 @@
-import { app, BrowserWindow, shell, screen } from 'electron'
+import { app, BrowserWindow, shell, screen, session } from 'electron'
 import { join } from 'node:path'
 import { AuthService } from './auth/authService'
 import { HelixClient } from './twitch/helixClient'
@@ -8,6 +8,10 @@ import { startGamepadReader } from './input/gamepadReader'
 
 const isDev = !app.isPackaged
 
+// Erlaubt video.play() ohne vorangehende User-Geste (nötig, weil play() in hls.js-Callbacks
+// aufgerufen wird, die asynchron weit nach dem ursprünglichen Click-Event stattfinden).
+app.commandLine.appendSwitch('autoplay-policy', 'no-user-gesture-required')
+
 function createWindow(): BrowserWindow {
   const isLinux = process.platform === 'linux'
   const { width, height } = isLinux
@@ -49,7 +53,45 @@ function createWindow(): BrowserWindow {
   return win
 }
 
+/**
+ * CORS-Bypass für Twitch CDN und HLS-Streams.
+ * hls.js im Renderer sendet Requests von localhost/file:// — Twitch CDN erwartet
+ * Origin: https://www.twitch.tv. Wir setzen Origin + Referer auf ausgehenden Requests
+ * und ergänzen CORS-Response-Header, damit Chromium die Antworten akzeptiert.
+ */
+function setupTwitchCors(): void {
+  const isTwitchCdn = (url: string): boolean =>
+    url.includes('twitchsvc.net') ||
+    url.includes('cloudfront.net') ||
+    url.includes('twitch.tv') ||
+    url.includes('twitch.amazon.com')
+
+  session.defaultSession.webRequest.onBeforeSendHeaders((details, callback) => {
+    if (isTwitchCdn(details.url)) {
+      details.requestHeaders['Origin'] = 'https://www.twitch.tv'
+      details.requestHeaders['Referer'] = 'https://www.twitch.tv/'
+    }
+    callback({ requestHeaders: details.requestHeaders })
+  })
+
+  session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
+    if (isTwitchCdn(details.url)) {
+      const headers: Record<string, string[]> = {}
+      for (const [k, v] of Object.entries(details.responseHeaders ?? {})) {
+        headers[k.toLowerCase()] = Array.isArray(v) ? v : [v]
+      }
+      headers['access-control-allow-origin'] = ['*']
+      headers['access-control-allow-headers'] = ['*']
+      headers['access-control-allow-methods'] = ['GET, HEAD, OPTIONS']
+      callback({ responseHeaders: headers })
+    } else {
+      callback({})
+    }
+  })
+}
+
 app.whenReady().then(async () => {
+  setupTwitchCors()
   const clientId = import.meta.env.MAIN_VITE_TWITCH_CLIENT_ID ?? ''
   const auth = new AuthService(clientId)
   await auth.init()
@@ -66,7 +108,7 @@ app.whenReady().then(async () => {
 
   app.on('before-quit', () => {
     stopGamepad()
-    playback.stopAll()
+    playback.stop()
   })
 
   if (!clientId) {