feat: Phase 0 security hardening (auth, CI, stop the bleeding)

[soos3d]

Summary

Implements Phase 0 from docs/PLAN.md on the current video-feed/videofeed/ layout (no repackage / no /api/v1 yet):

• Auth: session cookie + Bearer sx_ API keys; rate-limited login; admin-scoped DELETE; fail-closed until admin set-password
• Hardening: kill detail=str(e), XSS-safe templates, fix recordings UI to /api/recordings
• Network: default bind 127.0.0.1, remove unauthenticated /paths side-server, rtspEncryption: strict, redact CLI stream secrets (credentials show-stream)
• CI: GitHub Actions on Ubuntu 3.11/3.12 with slim web-test stack (no torch); 27 characterization/auth/config tests

Operator notes (post-merge)

cd video-feed && pip install -r requirements.txt
python -m videofeed.surveillance admin set-password
# optional: python -m videofeed.surveillance apikey create --name local --scope admin
# stream passwords: python -m videofeed.surveillance credentials show-stream

Open http://127.0.0.1:8080/login.

Test plan

• PYTHONPATH=. pytest tests/test_api_characterization.py tests/test_auth.py tests/test_config_security.py (27 passed on Python 3.12)
• CI green on this PR
• Manual smoke: set-password → login → MJPEG/viewer + recordings list → admin delete → logout → media 401
• Manual: bearer curl with read vs admin key on GET/DELETE
• Manual: credentials show-stream works; status/print_urls no longer embed user:pass@