feat(video): short-lived signed URLs for original-quality playback

POST /video/original mints a URL for one video's original bytes, signed
with a key derived from SECRET_KEY (distinct from the login-token key)
and valid for 6 hours. GET /video/original/stream?token= serves it via
NamedFile, so Range/seek works, without an Authorization header — native
players can use it directly. HLS stays the default path.

Also extracts generate_video's library fallback into resolve_request_path
and fixes the stale /video/stream entry in CLAUDE.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main.rs

@@ -352,6 +352,8 @@ fn main() -> std::io::Result<()> {
                 .service(handlers::image::upload_image)
                 .service(handlers::video::generate_video)
                 .service(handlers::video::stream_hls_file)
+                .service(handlers::video::original_video_url)
+                .service(handlers::video::stream_original_video)
                 .service(handlers::video::get_video_preview)
                 .service(handlers::video::get_preview_status)
                 .service(hls_stats::hls_stats_handler)