fix(server-storage): positions by content, acknowledged keepalive, serial re-reads, token changes

- Moved playback positions are matched by content type and Xtream id and
  name the server playlist.
- Page-hide writes report whether the server took them; refused ones go
  back into the queue. Re-reads run one at a time.
- The access guard's 401 carries WWW-Authenticate: Bearer
  realm="iptvnator"; the interceptor and PwaService's raw fetches turn it
  into sign-in, so a token changed on the server is noticed on provider
  calls too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web-backend/src/app/storage/access-guard.spec.ts

@@ -30,6 +30,13 @@ describe('createAccessGuard', () => {
                 code: 'unauthorized',
             });
             expect(wrong.status).toBe(401);
+            // Lets the PWA tell it from a provider's 401 on a proxy route.
+            expect(wrong.headers.get('www-authenticate')).toBe(
+                'Bearer realm="iptvnator"'
+            );
+            expect(wrong.headers.get('access-control-expose-headers')).toBe(
+                'WWW-Authenticate'
+            );
         }));
 
     it('accepts the right token and lets preflight through', () =>

apps/web-backend/src/app/storage/access-guard.ts

@@ -1,5 +1,6 @@
 import { createHash, timingSafeEqual } from 'node:crypto';
 import type { RequestHandler } from 'express';
+import { SERVER_ACCESS_CHALLENGE } from '@iptvnator/shared/interfaces';
 
 /** Routes a browser must reach before it has a token. */
 const PUBLIC_PATHS = new Set(['/', '/health', '/config.js', '/v1/instance']);
@@ -24,11 +25,14 @@ export function createAccessGuard(token: string): RequestHandler {
             return;
         }
 
-        res.status(401).json({
-            message: 'This IPTVnator server requires an access token.',
-            status: 401,
-            code: 'unauthorized',
-        });
+        res.status(401)
+            .set('WWW-Authenticate', SERVER_ACCESS_CHALLENGE)
+            .set('Access-Control-Expose-Headers', 'WWW-Authenticate')
+            .json({
+                message: 'This IPTVnator server requires an access token.',
+                status: 401,
+                code: 'unauthorized',
+            });
     };
 }