status: consolidate the pill to one dot + one word; upgrade the panel

- pill: two host dots -> ONE consolidated state (down > slow > up) —
  the at-a-glance question is 'can I watch?', which is one state;
  per-host detail belongs in the tap panel
- panel: dashed slow-threshold line in the CDN sparkline (drawn at the
  server's real threshold, not a client copy) + origin up/down step
  sparkline so 'how long has the origin been down' is visible
- server: origin probe keeps a 20-sample hist like the CDN probe;
  DEGRADED threshold is now ANIWEB_CDN_KBPS (default 40) and is
  returned in /api/cdn so the UI draws the line at the live value
- tests: pill assertions switched to consolidated states; fixtures
  carry origin hist + threshold; assert both sparklines + threshold line
- docs: README + SPEC synced; preview on :8322 restarted (pid 44382)

SPEC.md

@@ -82,9 +82,11 @@ an exception falls through to the next provider, a `None` from
   position-event stream.
 - `GET /api/cdn` → CDN + origin health (background 64KB probe every
   3 min, ~1h history) — check whether "playback broken" is the CDN.
-  The header status pill is the single UI surface for this (tap opens
-  a panel: origin/CDN state, KB/s, sparkline of `hist`); the playback
-  failure overlay appends CDN context when degraded/down.
+  `DEGRADED` = below `ANIWEB_CDN_KBPS` (default 40). The header pill is
+  the single UI surface: one consolidated state (down > slow > up, one
+  dot), tap opens the panel (per-host state + KB/s, CDN sparkline with
+  the dashed threshold line, origin up/down sparkline of `origin.hist`);
+  the playback failure overlay appends CDN context when degraded/down.
 - `GET /stream/{token}` → proxied HLS. Token = base64url of the
   upstream URL (host-allowlisted against the providers' self-registered
   CDN hosts — anti-SSRF). Rewrites every non-comment line of m3u8