fix: ask clients to retry when live playlist is unavailable

[Ministorm3]

Problem

Two related failure paths around the live HLS playlist mishandle errors in ways that break players:

1. GET /iptv/session/{channelNumber}/hls.m3u8 returns 404 whenever TrimPlaylist yields None. That happens when live.m3u8 does not exist yet (ffmpeg has not written the first playlist), when the client disconnected, or when reading the playlist failed. This branch is only reachable when TryGetWorker succeeded, so the session demonstrably exists. 404 tells the client the resource is gone and carries no implication that it is temporary, so a client is behaving reasonably if it tears down a stream that was about to work.

2. A playlist that fails to parse never even reached that branch: HlsPlaylistFilter.TrimPlaylist caught the exception and fabricated a "successful" result — an empty playlist with media sequence 0 and no segments. The session endpoint served that as a 200, resetting the media sequence out from under the player. Worse, the segmenter's TrimAndDelete wrote that empty playlist over live.m3u8 on disk, turning a transient parse error into persistent corruption.

Change

Controller — Return 503 Service Unavailable with Retry-After: 1, which is what RFC 9110 defines for a resource that is temporarily unavailable. One second is well under the 4s segment duration (OutputFormatHls.SegmentSeconds), so a retrying client picks the stream up on its next poll.

Filter / session worker — IHlsPlaylistFilter.TrimPlaylist and TrimPlaylistWithDiscontinuity now return Option<TrimPlaylistResult> and yield None on failure, instead of fabricating an empty result (the bad playlist is still saved to the temp pool for diagnosis). Every failure now flows through one path: the session endpoint answers None with the 503 retry response above, and TrimAndDelete leaves the on-disk playlist and PlaylistStart untouched so the session can recover on the next cycle. This also removes an inconsistency where the filter rethrew only when saving the bad playlist also failed — a malformed playlist can no longer take down the session worker.

Cancellation now logs at debug rather than warning — the client has already disconnected, and this endpoint is polled continuously by every viewer, so it was steady warning-level noise for a non-failure.

This only affects the Legacy streaming engine; the next engine's multi-variant playlist points at live.m3u8 and does not reach this action.

Tests

• Adds ErsatzTV.Tests/Controllers/IptvControllerTests.cs covering all three branches of GetLivePlaylist. Verified the retry test fails against the previous NotFound() and passes with the change.
• Adds HlsPlaylistFilter_ShouldReturnNone_WhenPlaylistIsMalformed, a regression test for the fabricated-empty-result path; existing filter tests updated for the Option return type. Full ErsatzTV.Core.Tests suite passes (509).

A collaboration between @Ministorm3 and Claude Code