harden: stream-token host allowlist (SSRF), CSRF header on mutating routes, atomic JSON writes

- /stream/{token}: tokens are plain base64; allowlist https://hls.anidb.app
  so a session can't use the proxy for arbitrary URLs (new test)
- X-Aniweb:1 required on POST/DELETE except /login — SameSite=Lax is
  still sent on cross-site form POSTs, which could hit /account/delete
  (new test; SPA + tests send the header)
- tmp+os.replace writes for users/history/searches: a crash mid-write
  could corrupt the JSON -> load() returned {} -> silent data loss
- resume positions now read from full history (?all=1), not top-5
- pagehide bound once; savePos reads currentEp (no stale closures)
- account delete also removes the searches file; episodes TTL 5m
- ani-web.service: supervised restart (not installed; see header)
- gitignore pi-session dumps + .pytest_cache

server/upstream.py

@@ -131,7 +131,7 @@ def _master_variants(master_url):
 # cached public API (TTLs in seconds)
 search = lambda q: _cached(f"search:{q.lower()}", 300, _search, q)
 details = lambda s: _cached(f"details:{s}", 3600, _details, s)
-episodes = lambda i: _cached(f"episodes:{i}", 3600, _episodes, i)
+episodes = lambda i: _cached(f"episodes:{i}", 300, _episodes, i)  # 5m: airing shows gain eps
 languages = lambda e: _cached(f"languages:{e}", 3600, _languages, e)
 master_m3u8 = lambda e, l="eng": _cached(f"master:{e}:{l}", 3600, _master_m3u8, e, l)
 master_variants = lambda u: _cached(f"variants:{u}", 3600, _master_variants, u)