v0.40.0-tor.5

Restores what Reddit stopped serving. Since about the start of November its onion JSON API refuses r/all, feeds sorted by new, post search and profile info, whatever the client (seven TLS fingerprints tested), so those pages failed with "Reddit blocked this request". They now come from Reddit's GraphQL API, on the same onion.

Images (linux/amd64; this release also moves latest):

• ghcr.io/highda/redlib-tor-api:v0.40.0-tor.5
• ghcr.io/highda/redlib-tor-api-teddit:v0.40.0-tor.5

Fixed:

• r/all, /new feeds (single and /r/a+b), post search and user profiles work again, on the web and in the API.
• Anything else Reddit starts refusing falls back to GraphQL automatically, so the next block degrades instead of being an outage. Every page type also worked with GraphQL forced for all of them.

Added:

• Muxed MP4s with sound, proxied through Reddit's media onion (/packaged, and packaged-media.redd.it in /media/).

Also includes v0.40.0-tor.4: "still connecting" answers 503 with Retry-After after a start.

Changed:

• after cursors are opaque in the API: /r/a+b and search can return non-fullname cursors. Send them back URL-encoded (API_SURFACE.md).
• On profiles served by GraphQL, link_karma is the total karma and comment_karma is 0; Reddit gives no split there.

Heads-up: Reddit has announced a move to a logged-in-only site, tested in select markets outside the US in Q4 2026 (redlib-org#609). This release stays anonymous; if that reaches the onion and GraphQL, a Reddit session will be needed.

The GraphQL feeds come from Downdoot by Kruno, adapted from polak14's implementation via baalajimaestro's fork. Credits in fork/README.md, "Picked fixes".

Tested: fork/scripts/check.sh, the live smoke test through Tor (52/52), 27 live responses through Stealth-Continued's parser, and Stealth-Continued 2.7.0 on an emulator: Home sorted by new with a second page, All, search on all tabs, a profile, and a video with sound from a GraphQL feed.