Harden auth, add subtitles, vendor all assets locally

- Session cookies are HttpOnly + SameSite=Lax (Secure on HTTPS), with
  strict session-ID mode; the CSRF token from GET api/auth.php must now
  accompany every state-changing request (X-CSRF-Token header, or a csrf
  body field for the sendBeacon progress save), rotated at login.
- Failed sign-ins are throttled per username and IP via login_attempts
  (created lazily, so existing installs need no migration): 5 failures a
  username / 20 an IP inside 15 minutes answer 429 with Retry-After.
- A video's sibling .srt now appears as a CC button in the player;
  captions.php converts it to WebVTT (comma timestamps, legacy encodings,
  and the already-VTT files with out-of-spec 6-digit fractions).
- Plyr and Inter ship in assets/vendor/ instead of coming from CDNs, and
  anime.js is gone along with all scripted animations and the motion
  setting — the app now runs with no internet access at all.
- .htaccess denies direct access to videos/, includes/, config.php and
  schema.sql, so video URLs cannot bypass login on Apache.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm

api/auth.php

@@ -11,6 +11,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         'logged_in' => currentUserId() !== null,
         'username'  => currentUsername(),
         'allow_registration' => ALLOW_REGISTRATION,
+        'csrf'      => csrfToken(),
     ]);
     exit;
 }
@@ -22,15 +23,27 @@ if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
 }
 
 $data = json_decode(file_get_contents('php://input'), true) ?: [];
+verifyCsrfApi($data);
 $action   = $data['action'] ?? '';
 $username = trim($data['username'] ?? '');
 $password = $data['password'] ?? '';
+$ip       = $_SERVER['REMOTE_ADDR'] ?? '';
 
 switch ($action) {
     case 'login':
+        $wait = loginRetryAfter($username, $ip);
+        if ($wait > 0) {
+            http_response_code(429);
+            header('Retry-After: ' . $wait);
+            echo json_encode(['error' => 'Too many failed sign-in attempts. '
+                . 'Try again in ' . max(1, (int)ceil($wait / 60)) . ' min.']);
+            break;
+        }
         if (attemptLogin($username, $password)) {
-            echo json_encode(['ok' => true, 'username' => currentUsername()]);
+            clearLoginFailures($username);
+            echo json_encode(['ok' => true, 'username' => currentUsername(), 'csrf' => csrfToken()]);
         } else {
+            recordLoginFailure($username, $ip);
             http_response_code(401);
             echo json_encode(['error' => 'Invalid username or password.']);
         }
@@ -45,7 +58,7 @@ switch ($action) {
         $result = registerUser($username, $password);
         if ($result === true) {
             attemptLogin($username, $password);
-            echo json_encode(['ok' => true, 'username' => currentUsername()]);
+            echo json_encode(['ok' => true, 'username' => currentUsername(), 'csrf' => csrfToken()]);
         } else {
             http_response_code(422);
             echo json_encode(['error' => $result]);

api/library.php

@@ -203,6 +203,8 @@ switch ($view) {
             'prev_id'     => $prevId,
             'next_id'     => $nextId,
             'stream_url'  => 'stream.php?id=' . (int)$video['id'],
+            'captions_url' => srtFilePath($video) !== null
+                ? 'captions.php?id=' . (int)$video['id'] : null,
         ]);
         break;
 

api/progress.php

@@ -31,6 +31,7 @@ $data = json_decode($raw, true);
 if (!is_array($data)) {
     parse_str($raw, $data);          // sendBeacon posts form-encoded
 }
+verifyCsrfApi($data);
 
 $videoId  = (int)($data['video_id'] ?? 0);
 $position = max(0, (float)($data['position'] ?? 0));

api/quiz.php

@@ -67,6 +67,7 @@ if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
 }
 
 $data = json_decode(file_get_contents('php://input'), true) ?: [];
+verifyCsrfApi($data);
 $quiz = getQuiz((int)($data['quiz_id'] ?? 0));
 $answers = $data['answers'] ?? null;
 if (!$quiz || !is_array($answers)) {

api/reset.php

@@ -15,6 +15,7 @@ if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
 }
 
 $data  = json_decode(file_get_contents('php://input'), true) ?: [];
+verifyCsrfApi($data);
 $scope = (string)($data['scope'] ?? '');
 $id    = (int)($data['id'] ?? 0);
 

api/scan.php

@@ -11,6 +11,7 @@ if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
     echo json_encode(['error' => 'Method not allowed']);
     exit;
 }
+verifyCsrfApi();
 
 try {
     echo json_encode(['ok' => true, 'stats' => scanLibrary()]);