Decode MegaPlay's encrypted getSourcesNew payload

MegaPlay (behind both hianime and anikoto) stopped returning
sources.file in plaintext and now ships the stream URL in an
AES-256-CBC 'enc' field. Key/IV are static, hardcoded in their public
player JS (newclient.min.js) — anti-scrape obscurity, not access
control. Shared megaplay_sources() in upstream.py tolerates both
shapes, so a revert upstream breaks nothing.

Also: hianime master_m3u8 now raises when servers are listed but none
resolve (403s, stale format) instead of returning None — a listed-but
dead server is a provider fault, not 'no dub', and the old None
silently short-circuited the ANI_SOURCE fallback chain.

requirements.txt

@@ -5,6 +5,7 @@ fastapi==0.141.1
 uvicorn==0.52.4
 curl_cffi==0.16.0
 itsdangerous==2.2.0
+pycryptodome==3.23.0
 
 # tests
 pytest==9.1.1