feat(hls): add native HLS (m3u8) download protocol

New hls protocol in internal/protocol/hls (registered ahead of http):
- master playlist variant picking (highest bandwidth), RFC3986 segment
  URL resolution, fMP4 init segments, EXT-X-BYTERANGE, EXT-X-GAP skip
- AES-128 decryption with mid-playlist key rotation and sequence-derived
  IVs; explicit errors for live streams, SAMPLE-AES and multi-period fMP4
- concurrent segment downloads with retry, journal-based resume across
  pause/app restarts, automatic in-order merge into a single .ts/.mp4
- best-effort Content-Length probing for determinate progress
- anti-hotlink Referer/Cookie/UA via task extra headers (Go transport
  does not filter them)

Core: fix SchemeFilter extension match for URLs with query strings
(also benefits .torrent links); Flutter: Protocol.hls enum, hls protocol
config model (prevents config round-trip wipe) and HLS settings block
with localized labels in all 22 locales.

Tests: parser/crypto unit tests, httptest e2e (Referer-enforced CDN,
encrypted streams, byterange, pause/resume, store/restore) and an
opt-in live-site acceptance gate (HLS_LIVE_URL).

ui/flutter/lib/features/settings/presentation/pages/settings_page.dart

@@ -64,6 +64,8 @@ class _SettingsPageState extends ConsumerState<SettingsPage> {
   final _maxRunningController = TextEditingController();
   final _httpUserAgentController = TextEditingController();
   final _httpConnectionsController = TextEditingController();
+  final _hlsConnectionsController = TextEditingController();
+  final _hlsMaxRetriesController = TextEditingController();
   final _btListenPortController = TextEditingController();
   final _btSeedRatioController = TextEditingController();
   final _btSeedTimeController = TextEditingController();
@@ -95,6 +97,8 @@ class _SettingsPageState extends ConsumerState<SettingsPage> {
     _maxRunningController,
     _httpUserAgentController,
     _httpConnectionsController,
+    _hlsConnectionsController,
+    _hlsMaxRetriesController,
     _btListenPortController,
     _btSeedRatioController,
     _btSeedTimeController,
@@ -558,6 +562,32 @@ class _SettingsPageState extends ConsumerState<SettingsPage> {
                 ],
               ),
             ),
+            _SettingsBlock(
+              key: const ValueKey('settings-hls-block'),
+              title: 'HLS',
+              child: _SettingsGroup(
+                children: [
+                  SettingsItem(
+                    title: context.l10n.connections,
+                    child: _NumberSettingControl(
+                      fieldKey: const ValueKey('hls-connections-input'),
+                      controller: _hlsConnectionsController,
+                      min: 1,
+                      max: 256,
+                    ),
+                  ),
+                  SettingsItem(
+                    title: context.l10n.maxRetries,
+                    child: _NumberSettingControl(
+                      fieldKey: const ValueKey('hls-max-retries-input'),
+                      controller: _hlsMaxRetriesController,
+                      min: 0,
+                      max: 30,
+                    ),
+                  ),
+                ],
+              ),
+            ),
             _SettingsBlock(
               title: 'BitTorrent',
               child: _SettingsGroup(
@@ -939,6 +969,8 @@ class _SettingsPageState extends ConsumerState<SettingsPage> {
     _maxRunningController.text = _config!.maxRunning.clamp(1, 256).toString();
     _httpUserAgentController.text = _config!.protocolConfig.http.userAgent;
     _httpConnectionsController.text = _config!.protocolConfig.http.connections.clamp(1, 256).toString();
+    _hlsConnectionsController.text = _config!.protocolConfig.hls.segmentConnections.clamp(1, 256).toString();
+    _hlsMaxRetriesController.text = _config!.protocolConfig.hls.maxRetries.clamp(0, 30).toString();
     _btListenPortController.text = _config!.protocolConfig.bt.listenPort.clamp(0, 65535).toString();
     _btSeedRatioController.text = _config!.protocolConfig.bt.seedRatio.toString();
     _btSeedTimeController.text = (_config!.protocolConfig.bt.seedTime ~/ 60).clamp(0, 100000000).toString();
@@ -1034,6 +1066,18 @@ class _SettingsPageState extends ConsumerState<SettingsPage> {
       min: 1,
       max: 256,
     );
+    config.protocolConfig.hls.segmentConnections = _boundedInt(
+      _hlsConnectionsController,
+      fallback: config.protocolConfig.hls.segmentConnections,
+      min: 1,
+      max: 256,
+    );
+    config.protocolConfig.hls.maxRetries = _boundedInt(
+      _hlsMaxRetriesController,
+      fallback: config.protocolConfig.hls.maxRetries,
+      min: 0,
+      max: 30,
+    );
     config.protocolConfig.bt.listenPort = _boundedInt(
       _btListenPortController,
       fallback: config.protocolConfig.bt.listenPort,