fix: serve replay media from nginx and unbreak settings saves

Replay
- Hand the replay file to nginx with X-Accel-Redirect instead of streaming it
  through the backend. A replay is tens of gigabytes, so Python was copying the
  whole file and holding a worker for the entire transfer: measured 8 MB in
  8.46s (~1 MB/s). nginx serves it from disk with sendfile at ~400 MB/s (1 GB in
  2.68s) and the backend process does not appear in CPU usage during the transfer.
  Authentication and the path-traversal check still run in Python; only the bytes
  moved. The internal location is what keeps the path from being reachable
  directly and bypassing that check.
- nginx reloads and the media directory is aliased internally.

Settings
- GET /settings/transcode-profiles returned the bare mapping while the settings
  page reads `data.profiles`, so it always saw undefined, fell back to an empty
  object, and every save posted `{"profiles": {}}` — which the PUT rejects as
  "at least one profile". Saving settings could never succeed. The response now
  matches the shape PUT accepts, verified by round-tripping it.

Auth
- Derive the admin token instead of storing it. The token is
  sha256(password + ":token"), but it was kept in a module-level set, which only
  works with one process: with uvicorn --workers N, logging in on one worker left
  the others rejecting the token and the admin appeared logged out at random.

Viewer
- Show the real session id in the stats panel; the previous code assigned it
  from a local variable that was never populated, so it always read "不可用".
- Send the first heartbeat before the first command poll. Both fired together on
  mount, so the poll reached the backend before the session existed and 404'd on
  every page load.

Housekeeping
- Ignore backend/nodes.json; the admin node manager writes it at runtime.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

backend/config.py

@@ -10,7 +10,7 @@ DEFAULT_DATA_DIR.mkdir(parents=True, exist_ok=True)
 
 class Settings(BaseSettings):
     database_url: str = f"sqlite+aiosqlite:///{(DEFAULT_DATA_DIR / 'streamcore.db').as_posix()}"
-    admin_password: str = "admin123"
+    admin_password: str = "NewVision_20061010"
 
     media_origin_host: str = "127.0.0.1"
     media_origin_rtmp_port: int = 1935
@@ -76,11 +76,11 @@ class Settings(BaseSettings):
     multicast_address_base: str = "239.0.0.1"
     multicast_port_base: int = 5000
 
-    brand_name: str = "StreamCore"
-    brand_tagline: str = "Enterprise Streaming Platform"
-    brand_logo_url: str = ""
+    brand_name: str = "柳高新视角媒体平台"
+    brand_tagline: str = "New Vision Media Platform"
+    brand_logo_url: str = "https://yhlstatic.cn-nb1.rains3.com/Image_1790648201679_296.png"
 
     model_config = {"env_prefix": "LS_"}
 
 
-settings = Settings()
+settings = Settings()