fix: serve replay media from nginx and unbreak settings saves

Replay
- Hand the replay file to nginx with X-Accel-Redirect instead of streaming it
  through the backend. A replay is tens of gigabytes, so Python was copying the
  whole file and holding a worker for the entire transfer: measured 8 MB in
  8.46s (~1 MB/s). nginx serves it from disk with sendfile at ~400 MB/s (1 GB in
  2.68s) and the backend process does not appear in CPU usage during the transfer.
  Authentication and the path-traversal check still run in Python; only the bytes
  moved. The internal location is what keeps the path from being reachable
  directly and bypassing that check.
- nginx reloads and the media directory is aliased internally.

Settings
- GET /settings/transcode-profiles returned the bare mapping while the settings
  page reads `data.profiles`, so it always saw undefined, fell back to an empty
  object, and every save posted `{"profiles": {}}` — which the PUT rejects as
  "at least one profile". Saving settings could never succeed. The response now
  matches the shape PUT accepts, verified by round-tripping it.

Auth
- Derive the admin token instead of storing it. The token is
  sha256(password + ":token"), but it was kept in a module-level set, which only
  works with one process: with uvicorn --workers N, logging in on one worker left
  the others rejecting the token and the admin appeared logged out at random.

Viewer
- Show the real session id in the stats panel; the previous code assigned it
  from a local variable that was never populated, so it always read "不可用".
- Send the first heartbeat before the first command poll. Both fired together on
  mount, so the poll reached the backend before the session existed and 404'd on
  every page load.

Housekeeping
- Ignore backend/nodes.json; the admin node manager writes it at runtime.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

backend/routes/auth.py

@@ -1,12 +1,11 @@
 import hashlib
+import hmac
 from fastapi import APIRouter, HTTPException, Depends, Header
 from pydantic import BaseModel
 from config import settings
 
 router = APIRouter(prefix="/api/auth", tags=["auth"])
 
-_tokens: set[str] = set()
-
 
 class LoginRequest(BaseModel):
     password: str
@@ -23,26 +22,41 @@ def hash_password(pw: str) -> str:
 ADMIN_HASH = hash_password(settings.admin_password)
 
 
+def _token_for(password: str) -> str:
+    """The admin token for a password.
+
+    Derived, never stored. It used to live in a module-level set, which only works
+    while there is exactly one process: uvicorn loads this module once per worker,
+    so logging in on one worker left every other worker rejecting the token and
+    the admin appeared to be logged out at random. A value that can be recomputed
+    cannot drift between workers.
+    """
+    return hashlib.sha256(f"{password}:token".encode()).hexdigest()
+
+
+def _is_valid(token: str) -> bool:
+    # Constant-time compare against the one token this deployment can issue.
+    return hmac.compare_digest(token, _token_for(settings.admin_password))
+
+
 async def require_auth(authorization: str = Header(None)) -> bool:
     if not authorization:
         raise HTTPException(status_code=401, detail="Missing token")
     token = authorization.replace("Bearer ", "")
-    if token not in _tokens:
+    if not _is_valid(token):
         raise HTTPException(status_code=401, detail="Invalid token")
     return True
 
 
 @router.post("/login")
 async def login(body: LoginRequest):
-    if hash_password(body.password) != ADMIN_HASH:
+    if not hmac.compare_digest(hash_password(body.password), ADMIN_HASH):
         raise HTTPException(status_code=401, detail="Invalid password")
-    token = hashlib.sha256(f"{body.password}:token".encode()).hexdigest()
-    _tokens.add(token)
-    return {"token": token}
+    return {"token": _token_for(body.password)}
 
 
 @router.post("/verify")
 async def verify(body: VerifyRequest):
-    if body.token not in _tokens:
+    if not _is_valid(body.token):
         raise HTTPException(status_code=401, detail="Invalid token")
     return {"valid": True}