v1.2.0 — CSP, video player & iOS fixes

CSP & security

• Enabled CSP nonce generator for importmap bootstrap (was breaking all JS in production)
• Dropped style-src from nonce directives to unblock inline styles
• Preload hero background image only for unauthenticated users

Video player

• Pause stream immediately on back-navigation for instant visual feedback
• Fix stuck "Buffering" overlay after rebuffer resume with low buffer

iOS

• Fix remove/delete buttons invisible on touch devices (Continue Watching, Library, Wishlist, Watch History)
• Fix Watch History delete button nested inside anchor (invalid HTML)