Playback: retry flaky upstream, faster proxy fail, cache /stream in browser

- upstream._get: one 300ms retry on transient errors (CF 403/503, 429,
  5xx); 404 stays final. Fixes the 502 cluster that hls.js couldn't
  recover from (fragLoadTimeOut x3 in error log)
- /stream: upstream timeout 12s < hls.js fragLoadingTimeOut (20s), so a
  hung segment 502s first and hls.js retries instead of fatal-timing-out
- /stream responses: Cache-Control public max-age=86400 (VOD + token is
  the exact upstream URL => immutable); re-opens/re-seeks skip the proxy
- /api/stream: drop unused qualities (frontend never read it; saved a
  ~0.2s cold upstream round-trip per episode)
- app.js/style.css: max-age=300 instead of no-store
- test_history_page_and_delete: stale selector (home redesign removed
  the 'view all' link; use 'history ->')

SPEC.md

@@ -49,7 +49,7 @@ Two moving parts, no database, no framework on the frontend.
 - `GET /api/search?q=` → `[{id, slug_id, name, poster}]` (parse step 1)
 - `GET /api/anime/{slug_id}` → `{id, name, synopsis, mal_id, seasons:[{slug_id,name,id}]}`
 - `GET /api/anime/{id}/episodes` → `[{id, number, filler}]` (step 3, passthrough)
-- `GET /api/episode/{ep_id}/stream?lang=eng|jpn` → `{token, qualities}`
+- `GET /api/episode/{ep_id}/stream?lang=eng|jpn` → `{token}`
   (steps 5+6; token is base64url of the master m3u8 URL)
 - `GET /api/history` / `POST /api/history` → **per-user** watch
   history with position, persisted to
@@ -58,7 +58,10 @@ Two moving parts, no database, no framework on the frontend.
 - `GET /stream/{token}` → proxied HLS. Token = base64url of the
   upstream URL. Rewrites every non-comment line of m3u8 bodies to
   point back at `/stream/`; proxies master, variants, and segments
-  (bytes, no transcoding).
+  (bytes, no transcoding). Responses are `Cache-Control: public,
+  max-age=86400` — VOD playlists/segments are immutable and the token
+  is the exact upstream URL, so the browser disk cache serves re-opens
+  and re-seeks without touching the proxy.
 - `GET /login` / `POST /login` / `POST /logout` → multi-user auth:
   PBKDF2-SHA256 passwords (`server/users.py`; `users.json` 0600),
   signed 30-day cookie carrying the username, 5-fail/15-min