fix: serve replay media from nginx and unbreak settings saves

Replay
- Hand the replay file to nginx with X-Accel-Redirect instead of streaming it
  through the backend. A replay is tens of gigabytes, so Python was copying the
  whole file and holding a worker for the entire transfer: measured 8 MB in
  8.46s (~1 MB/s). nginx serves it from disk with sendfile at ~400 MB/s (1 GB in
  2.68s) and the backend process does not appear in CPU usage during the transfer.
  Authentication and the path-traversal check still run in Python; only the bytes
  moved. The internal location is what keeps the path from being reachable
  directly and bypassing that check.
- nginx reloads and the media directory is aliased internally.

Settings
- GET /settings/transcode-profiles returned the bare mapping while the settings
  page reads `data.profiles`, so it always saw undefined, fell back to an empty
  object, and every save posted `{"profiles": {}}` — which the PUT rejects as
  "at least one profile". Saving settings could never succeed. The response now
  matches the shape PUT accepts, verified by round-tripping it.

Auth
- Derive the admin token instead of storing it. The token is
  sha256(password + ":token"), but it was kept in a module-level set, which only
  works with one process: with uvicorn --workers N, logging in on one worker left
  the others rejecting the token and the admin appeared logged out at random.

Viewer
- Show the real session id in the stats panel; the previous code assigned it
  from a local variable that was never populated, so it always read "不可用".
- Send the first heartbeat before the first command poll. Both fired together on
  mount, so the poll reached the backend before the session existed and 404'd on
  every page load.

Housekeeping
- Ignore backend/nodes.json; the admin node manager writes it at runtime.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

backend/routes/streams.py

@@ -1,13 +1,15 @@
 import json
 import secrets
 import asyncio
+import mimetypes
 import time
 import ntpath
 from datetime import datetime, timedelta
 from pathlib import Path
+from urllib.parse import quote
 
 from fastapi import APIRouter, HTTPException, Depends, Request
-from fastapi.responses import FileResponse, StreamingResponse
+from fastapi.responses import Response, StreamingResponse
 from sqlalchemy import select
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -522,10 +524,34 @@ async def serve_replay(stream_id: int, preview: str | None = None,
     stream = await StreamService(db).get_stream(stream_id)
     if not stream:
         raise HTTPException(status_code=404, detail="Program not found")
-    path = _media_path(preview if preview is not None else stream.replay_file)
+    filename = preview if preview is not None else stream.replay_file
+    path = _media_path(filename)
     if not path:
         raise HTTPException(status_code=404, detail="Replay not available")
-    return FileResponse(path)
+
+    # Authentication and the path-traversal check happen above, in Python; the
+    # bytes are handed to nginx. Returning FileResponse here would stream the
+    # whole file through this worker, which for a multi-gigabyte replay means the
+    # file is copied twice and one worker is occupied for the entire transfer.
+    #
+    # nginx answers `X-Accel-Redirect` on its own response by serving the named
+    # internal location instead of relaying the body, so the client still sees a
+    # single normal response.
+    root = Path(settings.replay_media_dir).resolve()
+    relative = path.relative_to(root).as_posix()
+    # Quote each segment: replay names can contain spaces or non-ASCII characters,
+    # and nginx interprets the header as a URI.
+    location = "/media-internal/" + "/".join(quote(part) for part in relative.split("/"))
+
+    response = Response(status_code=200)
+    response.headers["X-Accel-Redirect"] = location
+    # Let the client buffer ahead and seek; nginx serves the range requests.
+    response.headers["Accept-Ranges"] = "bytes"
+    response.headers["Content-Type"] = mimetypes.guess_type(str(path))[0] or "application/octet-stream"
+    # A direct hit on the backend (no nginx in front) must not look like a valid
+    # empty file, or a misconfigured deployment would silently play nothing.
+    response.headers["X-Replay-File"] = relative
+    return response
 
 
 @router.post("/{stream_id}/remote-session")