feat: consolidate on the shadcn frontend and harden playback

Frontend
- Replace the Ant Design app with the shadcn/ui app as the single frontend,
  keeping the portfolio side-by-side revertible in this commit.
- Drop the abandoned mdui experiment and the AntD tree so there is one app,
  one router and one design system to maintain.

Live playback
- Stop racing the encoder. lowLatencyMode + liveSyncDurationCount:1 targeted a
  single 4s segment, so playback ran at up to 1.10x and the forward buffer
  bottomed out at 0.1s, re-buffering every segment. Measured over 40s:
  buffer min 0.1s -> 8.9s, rate 1.00 constant, 0 stalls.
- Remove the 落后 labels and the page-level edge-snapping timer that fought
  hls.js over two different definitions of "latency".
- Live can no longer be paused: the control is not rendered while it plays, so
  the icon can never misreport state.
- Fix autoplay: muted autoplay started silently and never unmuted, and the
  gesture that restored sound also toggled playback off. One owner now.

Source ("原画") rendition
- Publish the publisher's stream remuxed losslessly via -c:v copy alongside the
  transcoded ones, so a source option exists even when every ladder entry
  downsizes.
- Give renditions an ASCII path slug: the HLS path is part of the URL and
  MediaMTX rejects non-alphanumeric paths, so 原画 could never be served.

Backend
- Supervise MediaMTX from the backend: start it at boot and restart it on exit,
  never killing an origin it did not start.
- Clear stale HLS output before restarting an encoder; an ENDLIST-less playlist
  left by a dead encoder hangs hls.js forever.
- Mark JSON timestamps as UTC. utcnow().isoformat() emitted a naive string that
  JS read as local time, so every viewer heartbeat looked 8 hours old in UTC+8
  and the live board's active-viewer count was permanently zero.
- Rebind a viewer session when it arrives on another stream instead of failing,
  and survive the StrictMode double-heartbeat race on first insert.
- Replace the Linux-only /proc and os.getloadavg metrics with psutil.
- Complete MediaMTX's cookieCheck redirect inside /hls proxying, and hold the
  httpx client open for the streamed body.

Housekeeping
- Ignore RainOSS (it stores accessKeySecret), runtime output, TLS keys and
  .venv; remove generated screenshots, load test scripts and stray files.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

frontend/vite.config.ts

@@ -1,17 +1,45 @@
-import { defineConfig } from 'vite'
+import { fileURLToPath, URL } from 'node:url'
 import react from '@vitejs/plugin-react'
+import { defineConfig } from 'vite'
+
+// Local dev proxy target. Defaults to the production backend port (8080).
+// Override with BACKEND_TARGET when the loopback 8080 is occupied (e.g. by
+// an unrelated process) — e.g. BACKEND_TARGET=http://127.0.0.1:8081.
+const backendTarget = process.env.BACKEND_TARGET || 'http://127.0.0.1:8080'
 
 export default defineConfig({
   plugins: [react()],
+  resolve: {
+    alias: {
+      '@': fileURLToPath(new URL('./src', import.meta.url)),
+    },
+  },
   server: {
-    allowedHosts: ['nbd.rainplay.cn', '.rainplay.cn'],
+    allowedHosts: ['nbd.rainplay.cn', '.rainplay.cn', '.server2.y-dev.tech', 'live.server2.y-dev.tech', 'us.dl.y-dev.tech'],
     proxy: {
       '/api': {
-        target: 'http://127.0.0.1:8080',
+        target: backendTarget,
         changeOrigin: true,
       },
       '/hls': {
-        target: 'http://127.0.0.1:8080',
+        target: backendTarget,
+        changeOrigin: true,
+        // Default "same-origin" strips the Referer. /hls/<key>/<label>/… carries the
+        // quality label, which is Chinese by default ("原画"), and a stripped Referer
+        // makes some proxies drop the rate-limited request. Not needed for the other
+        // routes, which only carry numeric ids.
+        referrerPolicy: 'origin-when-cross-origin',
+      },
+      '/docs': {
+        target: backendTarget,
+        changeOrigin: true,
+      },
+      '/openapi.json': {
+        target: backendTarget,
+        changeOrigin: true,
+      },
+      '/redoc': {
+        target: backendTarget,
         changeOrigin: true,
       },
     },