Save watch position on fatal player error; make failure test CDN-independent

playerFail() is the single choke point for every fatal error (hls.js fatal,
v.onerror, autoplay block) but never saved the position — periodic saves
(timeupdate) stop when hls is destroyed, so a fatal error at e.g. 40s lost
everything after the last 10s save. Call savePos() there.

test_stream_failure_retry redesigned around that: it no longer needs a
healthy CDN (which hangs on segment bytes intermittently). It waits only for
playlist metadata (duration comes from the VOD playlist, not segment bytes),
wipes the show's history, seeks to 6s (below the 10s periodic-save threshold,
above the 3s minimum — so only an error-time save could persist it), aborts
/stream to force a deterministic fatal, and asserts the position landed.
Retry-recovery now asserts a fresh token fetch instead of segment playback.

static/app.js

@@ -635,6 +635,10 @@ function playerHideOverlay() {
 function playerFail(msg) {
   if (!currentEp) return;
   playerBroken = true;
+  // a fatal error stops the periodic saves (timeupdate/pause never come
+  // again); persist the position now or the user loses everything since
+  // the last 10s save when they leave
+  savePos();
   const { ep_id, ep_no } = currentEp;
   postEvent({type: "error", detail: msg, ep_id, ep: ep_no, lang});
   playerOverlay("Playback failed: " + msg, () => play(ep_id, ep_no));