Subtitles: wire hianime's external .vtt into the player

- hianime.py: capture the first .vtt from the deobfuscated embed JSON
  (SUBS), expose subtitles(ep_id)
- upstream.py: subtitles() dispatcher (None for anidb, which bakes subs in)
- app.py: /api/episode/{id}/stream also returns a 'sub' stream token
- app.js: add a native <track> after hls.attachMedia (hls.js _cleanTracks
  disables tracks present at attach time — that silently killed earlier
  attempts) and set mode=showing so Chrome fetches the cues

static/app.js

@@ -927,6 +927,17 @@ async function play(ep_id, ep_no) {
     const s = await api(`/api/episode/${ep_id}/stream?lang=${lang}`);
     stopHls();
     const v = videoEl();
+    let subTrack = null;
+    if (s.sub) {
+      // external subtitle track (hianime serves a .vtt; anidb bakes subs in).
+      // native <track> works on MSE video (same as dash.js); served via /stream
+      // so the referer-hungry CDN is behind our proxy. Appended AFTER the
+      // branch below: hls.js's attachMedia runs _cleanTracks, which disables
+      // every track present at attach time
+      subTrack = document.createElement("track");
+      subTrack.kind = "subtitles"; subTrack.srclang = "en"; subTrack.label = "English"; subTrack.default = true;
+      subTrack.src = "/stream/" + s.sub;
+    }
     v.playbackRate = +(localStorage.getItem("aniweb_spd") || 1);
     document.getElementById("player").replaceChildren(v);
     playerOverlay("Loading\u2026", null, null, true);
@@ -1007,6 +1018,7 @@ async function play(ep_id, ep_no) {
         ov: (document.querySelector(".pl-overlay")?.textContent || "").slice(0, 60)});
     }, 15000);
     }
+    if (subTrack) { v.append(subTrack); subTrack.mode = "showing"; }
     currentEp = {ep_id, ep_no, v};
     lastSavedPos = 0;
     lastSeenPos = 0;