fix playback: vendor hls.js locally, surface stream/API errors visibly

- jsdelivr CDN was a silent single point of failure (Hls undefined ->
  unhandled rejection -> black screen with no feedback)
- play() now catches API errors; hls fatal + video media errors render
  'Stream error: ...' under the player
- server now binds 0.0.0.0 (LAN access); was 127.0.0.1 only

static/index.html

@@ -14,7 +14,7 @@
   </form>
 </header>
 <main id="main"><p class="muted">Search for an anime to get started.</p></main>
-<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/hls.min.js"></script>
+<script src="hls.min.js"></script>
 <script src="app.js"></script>
 </body>
 </html>