feat(overlay): add subtitle selection modal and Jellyfin 12 fixes

- Add an optional subtitle selection modal for primary/secondary mpv tracks (subtitleSelection.enabled, g-s sequence shortcut) with key-sequence conflict handling
- Authenticate Jellyfin URLs with the ApiKey query, answer remote keep-alives, clear now-playing on stop, and restore episode titles in Anki misc info
- Honor the configured mpv executable when Jellyfin starts playback via a shared mpv-process launcher
- Bump electron-builder to 26.16.1
- Condense and reconcile changelog fragments; update config example and docs

scripts/package-audit.cjs

@@ -59,10 +59,13 @@ function listFiles(root, prefix = '') {
   });
 }
 
+// asar resolves lookups with the platform separator, so stat with the listed
+// native path and only normalize the reported name.
 function listAppFiles(archive) {
   return asar.listPackage(archive).flatMap((entry) => {
-    const name = entry.replaceAll('\\', '/').replace(/^\//, '');
-    const stat = asar.statFile(archive, name);
+    const native = entry.replace(/^[\\/]/, '');
+    const stat = asar.statFile(archive, native);
+    const name = native.replaceAll('\\', '/');
     return 'size' in stat ? [{ path: name, bytes: stat.size }] : [];
   });
 }
@@ -137,7 +140,7 @@ function verifyContents(archive, resources, platform, arch) {
     assert(!name.path.startsWith('minecard'), `Demo media shipped: ${name.path}`);
   }
   for (const ui of ['renderer', 'settings', 'syncui']) {
-    const css = asar.extractFile(archive, `dist/${ui}/style.css`).toString();
+    const css = asar.extractFile(archive, path.join('dist', ui, 'style.css')).toString();
     assert(css.includes('../fonts/MPLUS1[wght].ttf'), `Shared font missing from ${ui} CSS`);
   }
   return entries;