fix(settings): keep the relock timeout behind the PIN and bind M3U group lock toggles to their playlist

A locked session can no longer change the relock timeout: the Settings
selector is disabled until the PIN is entered and the service refuses
the change while locked. An M3U right-click lock toggle now captures its
playlist before the PIN prompt and is saved only if that playlist is
still open.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/services/src/lib/parental-lock/parental-lock.service.spec.ts

@@ -355,6 +355,20 @@ describe('ParentalLockService', () => {
         expect(service.unlocked()).toBe(true);
     });
 
+    it('refuses a relock timeout change while the session is locked', async () => {
+        storage.pinHash = await hashParentalLockPin('1234');
+        parentalLockEnabled.set(true);
+        const service = await createService();
+        expect(service.active()).toBe(true);
+
+        await expect(service.setRelockMinutes(0)).resolves.toBe(false);
+
+        expect(updateSettings).not.toHaveBeenCalledWith(
+            expect.objectContaining({ parentalLockRelockMinutes: 0 })
+        );
+        expect(service.relockMinutes()).toBe(15);
+    });
+
     it('rolls the relock timeout back when it cannot be persisted', async () => {
         updateSettings.mockImplementationOnce(async () => {
             parentalLockRelockMinutes.set(30);

libs/services/src/lib/parental-lock/parental-lock.service.ts

@@ -360,6 +360,11 @@ export class ParentalLockService {
      * timer on screen never differs from the one the next launch uses.
      */
     async setRelockMinutes(minutes: number): Promise<boolean> {
+        // A locked session must not lengthen or switch off its own relock
+        // timer (Settings disables the selector until the PIN is entered).
+        if (this.active()) {
+            return false;
+        }
         return persistParentalLockRelockMinutes(
             this.settingsStore,
             minutes,