Decode MegaPlay's encrypted getSourcesNew payload

MegaPlay (behind both hianime and anikoto) stopped returning
sources.file in plaintext and now ships the stream URL in an
AES-256-CBC 'enc' field. Key/IV are static, hardcoded in their public
player JS (newclient.min.js) — anti-scrape obscurity, not access
control. Shared megaplay_sources() in upstream.py tolerates both
shapes, so a revert upstream breaks nothing.

Also: hianime master_m3u8 now raises when servers are listed but none
resolve (403s, stale format) instead of returning None — a listed-but
dead server is a provider fault, not 'no dub', and the old None
silently short-circuited the ANI_SOURCE fallback chain.

server/providers/anikoto.py

@@ -10,7 +10,7 @@ times until a CDN domain actually serves us.
 """
 import re
 
-from ..upstream import _cached, _get
+from ..upstream import _cached, _get, megaplay_sources
 
 BASE = "https://anikototv.to"
 XHR = {"X-Requested-With": "XMLHttpRequest"}
@@ -100,8 +100,8 @@ def _player_file(embed_url):
     if not m:
         return None
     host = re.match(r'https?://([^/]+)/', embed_url).group(1)
-    d = _get(f"https://{host}/stream/getSourcesNew?id={m.group(1)}",
-             headers={"Referer": embed_url, "X-Requested-With": "XMLHttpRequest"}).json()
+    d = megaplay_sources(_get(f"https://{host}/stream/getSourcesNew?id={m.group(1)}",
+             headers={"Referer": embed_url, "X-Requested-With": "XMLHttpRequest"}).json())
     return (d.get("sources") or {}).get("file")