fix(server-storage): positions by content, acknowledged keepalive, serial re-reads, token changes

- Moved playback positions are matched by content type and Xtream id and
  name the server playlist.
- Page-hide writes report whether the server took them; refused ones go
  back into the queue. Re-reads run one at a time.
- The access guard's 401 carries WWW-Authenticate: Bearer
  realm="iptvnator"; the interceptor and PwaService's raw fetches turn it
  into sign-in, so a token changed on the server is noticed on provider
  calls too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/shared/interfaces/src/lib/server-storage.contract.ts

@@ -36,6 +36,12 @@ export interface ServerInstanceInfo {
     readonly auth: 'none' | 'token';
 }
 
+/**
+ * `WWW-Authenticate` value of the access guard's 401. A provider error the
+ * proxy passes on never carries it, so a client can tell the two apart.
+ */
+export const SERVER_ACCESS_CHALLENGE = 'Bearer realm="iptvnator"';
+
 /**
  * Sent with every `PUT /v1/playlists/:id`: the document's ETag before that
  * write. A client that kept the stored payload (`keepPayload=1`) may cache