Subtitles: wire hianime's external .vtt into the player

- hianime.py: capture the first .vtt from the deobfuscated embed JSON
  (SUBS), expose subtitles(ep_id)
- upstream.py: subtitles() dispatcher (None for anidb, which bakes subs in)
- app.py: /api/episode/{id}/stream also returns a 'sub' stream token
- app.js: add a native <track> after hls.attachMedia (hls.js _cleanTracks
  disables tracks present at attach time — that silently killed earlier
  attempts) and set mode=showing so Chrome fetches the cues

server/app.py

@@ -533,7 +533,11 @@ def api_stream(ep_id: int, lang: str = "jpn", request: Request = None):
         master = _upstream(upstream.master_m3u8, ep_id, lang)
         if not master:
             raise HTTPException(404, f"no {lang} stream for episode {ep_id}")
-        return {"token": _b64(master)}
+        out = {"token": _b64(master)}
+        sub = upstream.subtitles(ep_id)  # external .vtt (hianime); anidb bakes subs in
+        if sub:
+            out["sub"] = _b64(sub)
+        return out
 
     try:
         out = go()