refactor: introduce playback control plane

[tcconnally]

Summary

• Introduce an immutable PlaybackPlan that keeps server-side transcoding and client decoder selection independent.
• Add bounded transcode admission through ResourceGovernor and bounded Emby session lifecycle/cleanup through EmbySessionBroker.
• Add explicit cell playback lifecycle/state identity checks, plan/state/broker telemetry, and pre-redaction analysis.json generation.
• Preserve the existing Qt/libmpv/native rendering path during the migration and document the ownership boundaries.

Verification

• python3 tests/run_all.py — overall PASS.
• Reliability: 73 passed.
• Playback plan: 11 passed.
• Playback state: 11 passed.
• Session broker: 7 passed.
• Diagnostics: 63 passed.
• macOS playback contracts: 60 passed.
• Optional PyQt6/native GUI lanes are skipped in this Linux environment and remain CI/platform evidence requirements.

Publication candidate

• Local/remote head: 2d1a276be66927e98b061f401f2f9d0b76cee1ec
• The branch also carries the previously committed display-selection, outage-retry, and diagnostics portability fixes that preceded the control-plane slice.
• No global auto-transcode suppression is enabled by this change; controlled direct-vs-transcode soak validation remains a follow-up.