Subtitles: wire hianime's external .vtt into the player

- hianime.py: capture the first .vtt from the deobfuscated embed JSON
  (SUBS), expose subtitles(ep_id)
- upstream.py: subtitles() dispatcher (None for anidb, which bakes subs in)
- app.py: /api/episode/{id}/stream also returns a 'sub' stream token
- app.js: add a native <track> after hls.attachMedia (hls.js _cleanTracks
  disables tracks present at attach time — that silently killed earlier
  attempts) and set mode=showing so Chrome fetches the cues

server/upstream.py

@@ -205,6 +205,17 @@ def stream_meta(url):
     return None
 
 
+def subtitles(ep_id):
+    """External .vtt url for an episode, or None (anidb bakes subs in)."""
+    for p in _providers():
+        fn = getattr(_prov(p), "subtitles", None)
+        if fn:
+            v = fn(ep_id)
+            if v:
+                return v
+    return None
+
+
 if __name__ == "__main__":
     # ponytail: assert self-check instead of a test framework.
     # Needs a live source: ANI_SOURCE=<provider> python -m server.upstream