docs(playback): state the exact override release points

Codex round-5 P2 flagged that the media 'ended' event does not clear the
scoped override while the player stays mounted. That is deliberate, not a
gap: a mounted player still owns the session — replay or a seek into an
unbuffered range must keep working against a gated stream, and clearing on
'ended' would 403 exactly the streams this PR fixes. The credentials only
ever travel to the exact origin that issued them, and every dismount path
(channel/source change, player close/destroy, radio close, playerless
selection) releases them. The security doc and the release note now say
precisely that instead of the ambiguous "cleared when playback ends".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.changes/playback-stalker-stream-credentials.md

@@ -7,6 +7,7 @@ issues: [849, 910, 732]
 Stalker portal streams that require the portal session now play in the
 built-in players (HTML5, Video.js, ArtPlayer), not only in VLC/MPV: the
 player's own requests carry the portal cookie and token, scoped to that
-stream and cleared when playback ends. VOD, series and radio streams get the
-same portal headers live TV already had, including on same-host streaming
-ports.
+stream and dropped when the player closes or the channel changes. VOD,
+series and radio streams get the same portal headers live TV already had,
+including on same-host streaming ports and when opened from Favorites or
+Recently Viewed.

docs/architecture/electron-security.md

@@ -171,8 +171,13 @@ deliberately stricter than the general scope:
   also cover, and never to third-party hosts an HLS manifest may point at
 - they live only in the in-memory override: never in the session cookie jar,
   never on disk, so they cannot outlive the app process
-- they are dropped whenever the scoped override is replaced (channel change)
-  or cleared (playback end, `WebPlayerViewComponent` destroy)
+- they are dropped whenever the scoped override is replaced (channel or
+  source change) or released — player close/destroy, a radio host's close, or
+  a new selection that mounts no player surface. The media `ended` event
+  deliberately does **not** clear the override: the mounted player still owns
+  the session (replay, or a seek into an unbuffered range, must keep working
+  against a gated stream), and the credentials only ever travel to the exact
+  origin that issued them; every dismount path above releases them
 
 The header-injection design was chosen over `session.cookies.set()`
 deliberately: jar cookies only attach to credentialed requests, which would