v1.1.0 — Security & correctness review fixes

Security

• RealDebrid API key leak via logs — Torrentio resolve URLs embed the RD key in the path; ContentStreamingService logged them verbatim. Now logs only imdb_id + filename.
• RealDebridService#with_retry infinite loop — retry re-executed the method body, resetting retries=0 on every network failure, hanging the calling thread forever on a persistent RD outage. Restructured with an explicit loop.
• Orphaned HLS ffmpeg processes — HlsSession.cleanup_expired was never scheduled. Added a recurring job (every 5 min); HlsSession.stop now falls back to the persisted record.pid so the SolidQueue worker can kill orphaned ffmpeg from other Puma workers.
• SSRF DNS-rebinding TOCTOU — valid_stream_url? resolved the host and rejected private IPs, but ffmpeg re-resolved independently. Added verify_stream_url! (re-resolve before spawn) + an outbound host allowlist (RealDebrid CDN + provider resolve origins only).
• force_ssl + assume_ssl enabled in production (were commented out despite the app carrying session cookies + RD keys).
• Content-Security-Policy enabled (initializer was fully commented out).
• Open redirect via Referer — content/show linked to raw request.referer. Replaced with internal route helpers.

Correctness

• Reject non-positive progress saves — save_progress used blank?, which is false for 0.
• Idempotent + transactional move_to_library — create! raised 500 on duplicate; now find_or_create_by! inside a transaction.

Performance

• Cache + parallelize home page catalog calls — the 4 cinemeta calls were sequential and uncached; now cached (1h TTL) and run concurrently.
• Cache movie stream listings (60s TTL) in ContentController.

Quality

• Reword the Active Record encryption comment (was misleading — nil is fail-closed).
• Set Devise mailer_sender from MAILER_FROM env (was placeholder).
• Add XSS invariant comment to episode_picker innerHTML sink.

Tests: 248 examples, 0 failures.