fix(portals): gate VOD auto-failover on engines that can report failures

Merges master and resolves the collision with its shared playback helpers,
then closes two Codex findings.

Master extracted the Play/Stop button state and the inline position writer
that this branch had modified. Rather than forking private copies back out of
Xtream, both behaviours move into the shared helpers: `alsoOwns` lets a page
own an external session launched for a copy of the same film in another
playlist, and the resume latch — which stops a timeupdate emitted before the
engine reaches `startTime` from overwriting the point being resumed from —
now protects Stalker too, which had the same bug.

Auto-failover was offered on every engine, but only the built-in web players
raise the playback diagnostic that reaches `onPlaybackFailed()`: Embedded MPV
has its diagnostics suppressed and MPV/VLC play outside the app. The toggle is
now hidden there, in settings and in the sources menu, instead of promising a
switch that can never happen.

`setAutoFailover` also ignored `updateSettings()`, which patches memory first
and rejects if the write fails — the toggle looked saved, silently reverted on
restart, and the rejection surfaced only as an unhandled promise. It now
reports the failure like the settings form's own save paths.

The three VOD-details route specs each carried a near-identical 150-line
TestBed; they now share one harness, which is what makes room for the new
cases (1012 -> 584 lines).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/architecture/vod-multi-source.md

@@ -14,7 +14,7 @@ current source is dead, serves an unsupported codec, or buffers badly.
 | Source types | **Xtream ↔ Xtream only** |
 | Content | Movies only — series are not offered a source chip |
 | Environment | **Electron only** — the chip renders nothing in the PWA |
-| Auto-failover | Opt-in, **off by default** (`Settings.vodAutoFailover`) |
+| Auto-failover | Opt-in, **off by default** (`Settings.vodAutoFailover`); offered only on the built-in web players |
 | Pin scope | Per movie (a global portal priority is out of scope) |
 | Stream probe | HEAD → reachable + latency, sent with the playlist's own playback headers. **No codec probing** |
 
@@ -410,3 +410,16 @@ than merely lacking a convenience.
 Every entry point is gated on a bridge `typeof` check (`isAvailable`), matching
 `CatalogTitleMatchService`. In the PWA the chip renders nothing and the
 auto-failover setting is hidden.
+
+## Which engines can fail over
+
+Only the built-in web players (HTML5, Video.js, ArtPlayer) raise the playback
+diagnostic that reaches `onPlaybackFailed()`. `WebPlayerViewComponent`
+suppresses it for Embedded MPV, and external MPV/VLC never mount that component
+at all — a stream that dies there is invisible to the app.
+
+So the toggle is hidden, not merely inert, on those engines: in
+`Settings > Playback` (`reportsPlaybackFailures()` gating the row) and in the
+sources menu (`autoFailoverSupported`). Leaving it visible would let a user
+switch on a feature that can never fire. The stored preference is untouched by
+the change — switching back to a web player restores whatever was set.