feat(mediaauth): policy-based playback authorization

[ntt0601zcoder]

Summary

Reworks media-plane (playback) authorization from a single global config into first-class, reusable Policy objects.

• A Policy is a stored entity (CRUD via /policies) that carries a complete, self-contained rule set: require_token + its own token_secret, plus static allow/deny lists for IP (exact or CIDR), country (ISO-3166-1 alpha-2), user-agent (substring), and referer domain.
• A stream binds to at most one policy via playback_policy (templates carry the same field and inherit it). A stream with no policy is public (allow-all); a reference to an unknown policy fails closed (deny).
• There is no global media-auth config anymore — every rule lives on a policy.

API

/policies (admin-auth group):

• GET /policies — list
• GET /policies/{code} — get
• POST /policies/{code} — create/replace (validated; URL code is authoritative)
• DELETE /policies/{code} — refused with 409 POLICY_IN_USE while any stream or template still references it

Tokens are client-signed, server-verify-only (HMAC-SHA256 over <stream_code>|<exp>, keyed by the policy's secret). The MAC binds to the stream code, so a token minted for one stream never authorizes another.

Behaviour

• The authorizer keeps the compiled policy set in an atomic pointer; every CRUD change hot-swaps it with no stream restart, and it is loaded once at boot.
• Resolution: live streams use the publisher's in-memory binding (no store read on the hot path); stopped streams serving a DVR archive fall back to the store + template.

Breaking change / migration

The global media-auth config block and the playback_auth field are removed. Recreate playback rules as Policy entities and bind streams via playback_policy. Streams that previously set playback_auth become public until re-bound to a policy.

Tests

• New: domain Policy.Validate, json/yaml PolicyRepository, mediaauth chain rewritten for the per-policy model (deny/allow per dimension, token sign/verify/expiry/tamper/cross-stream, unknown-policy fail-closed, hot-reload).
• go build, go vet, golangci-lint (0 issues), and go test -race -shuffle=on ./... all green.