fix(portals): restart honours the pin, and a switch replaces the player

Three from review, all in the pinned-playback seam.

A pinned copy watched through resolved to its stored seconds, so the button
read Play — the label uses the in-progress rule — and then started near the
end. Both now go through one `isResumablePosition`, so the label and the start
point cannot disagree.

Restart sat beside a Resume that honours a foreign pin, but called `playVod`
and started the ROUTE copy — silently switching the user's playlist. It now
restarts whatever the primary button acts on, falling back to the route source
only when there is no usable pin.

Switching sources left a running external player alone. With MPV or VLC and
instance reuse off the backend spawns a second detached process, so both
sources kept playing and Stop owned only the newer one.

Also merges master, and puts the five host specs on a shared harness — they
each carried the same 31-line TestBed, which is what pushed two of them over
the file-size cap as cases were added.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/architecture/vod-multi-source.md

@@ -453,7 +453,12 @@ which replace whatever timecode an alternative left in the controller.
 While the pinned copy is the one playing, its live position wins over the row
 that was stored before this session started.
 
-A pin means the button plays a copy the page did not load a position for.
+A pin means the button plays a copy the page did not load a position for. A
+watched-through copy resolves to zero rather than its stored seconds, through
+the same `isResumablePosition` rule the label uses — otherwise the button reads
+Play and then seeks back to where the film ended. Restart follows the pin for
+the same reason: with Resume honouring a pinned copy, a Restart that started
+the route copy would silently switch the user's playlist.
 `createPrimaryActionPosition` therefore looks that copy's row up and lets it
 govern the label, the timecode and the Restart affordance — including when the
 lookup comes back empty, because "never watched" is an answer: the button must
@@ -468,6 +473,11 @@ object carrying `codec_name`/`width`/`height`. `readStreamInfo` accepts both —
 reading only the object silently lost the codec on every array response, and
 with it the "dub may differ" warning, which compares stated audio tracks.
 
+Switching sources through `startResolvedPlayback` closes a matched external
+session first. It REPLACES what is playing — with MPV or VLC and instance
+reuse off, the backend would otherwise spawn a second detached player, leaving
+both sources running and Stop owning only the newer one.
+
 ## Claims about the present
 
 `isActive` means "the source a switch or Play would use" — selection, not