feat: unify VOD covers and add isolated personal alpha packaging

[simonhagger]

Movie and series covers offered different actions and indicators across the Dashboard, catalogue, search and collections. This tranche gives them shared favourite, progress and attributed-rating indicators with a Material three-dot menu. It also adds an opt-in personal Windows distribution for using the fork independently of the standard app.

Series show Started and current episode progress. Completing one episode does not mark the whole show watched. Recent episode rows retain their own history/removal identity while Details and favourites resolve to the parent show. A show and episode sharing a provider ID remain separate. Unresolved parent actions are unavailable; Details never consumes an autoplay handoff. Closing inline Details refreshes saved cover state.

Failed membership or progress reads offer Retry, including progress-only failures in Favorites. Successful empty history stays distinct from an error. Recovery merges cover fields onto current rows, preserving removals, ordering and current persisted favourites. Newer requests/retries and disposal supersede old results. Keyboard menus restore focus without activating the cover. Catalogue E2E activates the primary cover button and waits for actual detail/title readiness while retaining its pagination and scroll-restoration assertions.

PWA strict membership reads propagate denied storage access, malformed maps, invalid snapshots and incomplete hydration. An absent key remains known-empty and historical numeric-string IDs remain supported. Favourite add/remove operations reject unsafe current membership before writing. Validation loads at the async PWA boundary, followed by a fresh storage read with no await before writing. Legacy public read fallbacks remain compatible and share one pure ID normalizer. The browser recovery journeys preserve exact saved membership and keep Details available while favourite state is unknown.

Shared presentation consumes immutable models and emits intent. Controllers perform one bulk position read per represented provider playlist, serialize favourite writes and read back persisted membership. Identity includes provider, playlist, content kind and provider ID. Complete membership reads avoid false negatives beyond 500 rows. Pure selectors resolve history and progress without mutating payloads. Translations, release notes and cover/state-ownership guidance accompany the change.

The personal packaging overlay preserves version 0.25.0 and uses a distinct app/installer identity and ~/.iptvnator-personal. It skips legacy-profile adoption and disables startup/manual updates, upstream release notes, downloads and update installation. Package metadata is validated before profile writes. Standard packaging retains its existing behavior. The private build keeps the explicit optimized production output; this PR does not publish a public release.

Validation:

• Production frontend/backend types and all 37 registered spec programs pass.
• Owning collection data/UI and Xtream adapter tests pass 76 suites and 879 tests after the storage recovery repair. The broader nine-project cover run passed 244 suites and 2,682 tests before that repair. Personal-build backend/path/About/policy tests also pass.
• All 17 affected lint targets passed; final recovery owning lint and the new E2E file pass again. Formatting introduces no regression; four pre-existing files remain unformatted.
• Translation drift, release notes, font weights, Material tokens, stylesheet inputs and guidance checks pass. All 19 locales have the progress error message.
• Optimized Electron/native and PWA builds pass. Initial renderer payload is 1,609,035 bytes against the unchanged 1,609,142-byte limit.
• Five catalogue cases, six cover/theme/inline-return flows, two progress-failure/recovery journeys, two PWA membership-failure/recovery journeys and the Chromium posters-only journey pass without retries. The fault journeys fail on the prior build and pass after the repair; the native synthetic handler waits for an observed failing invocation before recovery. Four PWA mutation regressions fail before and pass after the write guard. Isolated processes exit and mock ports close. Error/recovery and light/dark cover screenshots were inspected. Earlier affected Dashboard, collection persistence/navigation, search and complete-membership journeys also pass.
• Standalone Electron/browser E2E typechecking retains 189/1 existing diagnostics. Read-only compiler overlays of fork master reproduce every diagnostic with zero additions. These commands are not claimed as green.
• The Windows full packaging unit target reproduces 70 unchanged Linux-fixture failures, with no new failure names. Its personal packaging and identity tests pass. Linux CI validation is required before merge.

The first complete GitHub round passed 26 checks, including platform builds, units/typechecks, lint, performance and browser E2E. Three catalogue E2E shards failed in helpers corrected here. All collected repairs remain subject to a fresh complete CI round.

All local feature testing is on Windows. These features are alpha; macOS and Linux have not been manually tested. Tests use isolated profiles, mock providers and local media without subscription credentials. Native-speaker review of added locale text remains pending. The private installer will be delivered only after fork merge and verification of its actual packaged playback/PiP behavior.

Local Codex review is clean on a47263183ee6b7c0fb19e505aec2ba6b6faf14f2. No findings were declined. Its automated checks could not run after an installed-lock comparison and aborted offline install; coordinator checks above passed with a normalized matching installed lock. Greptile CLI is unavailable, using the repository's documented exception.