Fix CPU HLS streaming (yuv420p) and opt-in middleware for fragments

- Add -pix_fmt yuv420p to multi_res_output.py libx264 path so browsers
  can decode CPU-encoded segments (was producing yuv444p / High 4:4:4).
- Switch silent auth check and coop fragment middlewares from opt-out
  blocklists to opt-in: only run for GET requests with Accept: text/html.
  Prevents unnecessary nav-tree/auth-menu HTTP calls on every HLS segment,
  IPFS proxy, and API request.
- Add opaque grant token verification to L1/L2 dependencies.
- Migrate client CLI to device authorization flow.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

l1/streaming/multi_res_output.py

@@ -244,6 +244,7 @@ class MultiResolutionHLSOutput:
                 "-bufsize", f"{quality.bitrate * 2}k",
             ])
         cmd.extend([
+            "-pix_fmt", "yuv420p",  # Required for browser MSE compatibility
             "-g", str(int(self.fps * self.segment_duration)),  # Keyframe interval = segment duration
             "-keyint_min", str(int(self.fps * self.segment_duration)),
             "-sc_threshold", "0",  # Disable scene change detection for consistent segments