harden: stream-token host allowlist (SSRF), CSRF header on mutating routes, atomic JSON writes

- /stream/{token}: tokens are plain base64; allowlist https://hls.anidb.app
  so a session can't use the proxy for arbitrary URLs (new test)
- X-Aniweb:1 required on POST/DELETE except /login — SameSite=Lax is
  still sent on cross-site form POSTs, which could hit /account/delete
  (new test; SPA + tests send the header)
- tmp+os.replace writes for users/history/searches: a crash mid-write
  could corrupt the JSON -> load() returned {} -> silent data loss
- resume positions now read from full history (?all=1), not top-5
- pagehide bound once; savePos reads currentEp (no stale closures)
- account delete also removes the searches file; episodes TTL 5m
- ani-web.service: supervised restart (not installed; see header)
- gitignore pi-session dumps + .pytest_cache

ani-web.service

@@ -0,0 +1,17 @@
+# Supervised replacement for run.sh's nohup (crash -> auto-restart).
+# Install (then stop the run.sh instance: pkill -f 'uvicorn .*app:app'):
+#   sudo ln -s /home/jozamudi/code/ani-cli-front-end/ani-web.service /etc/systemd/system/
+#   sudo systemctl daemon-reload && sudo systemctl enable --now ani-web
+[Unit]
+Description=ani-web (FastAPI anime front-end)
+After=network-online.target
+
+[Service]
+WorkingDirectory=/home/jozamudi/code/ani-cli-front-end
+Environment=ANIWEB_SECURE=1
+ExecStart=/home/jozamudi/code/ani-cli-front-end/.venv/bin/python -m uvicorn server.app:app --host 0.0.0.0 --port 8321
+Restart=always
+RestartSec=2
+
+[Install]
+WantedBy=multi-user.target