feat(stream)!: retire WebRTC, HLS-only, bump 0.9.4

Drops the custom WebRTC DataChannel pipeline + pion deps + WSS signaling
client + wire framing. Every in-browser playback now uses HLS over HTTP
from the daemon (Tailscale/LAN/UPnP). Browser P2P never re-enabled.

Wire renames (incompatible with web < 2026-05-26): agent.WebRTCSession
=> agent.StreamSession, SyncResponse.WebRTCSessions (JSON: webrtcSessions)
=> StreamSessions (JSON: streamSessions). MIN_AGENT_VERSION is bumped
to 0.9.4 on the web side so older agents see an upgrade card.

Also fixes the libx264 'VBV bitrate > level limit' abort by clamping
the encoder bitrate to the effective output height instead of the
requested label (carried over from the prior 0.9.3 unreleased work).

The seed_file vertical (mode=seed_file handler + engine.SeedFile) was
retired with the in-browser P2P player. [downloads.webrtc] config block
deleted; existing TOML files with the section still parse fine.

.github/workflows/ci.yml

@@ -86,14 +86,11 @@ jobs:
         run: |
           # Threshold applies only to engine and agent — cmd contains interactive UI
           # commands (config menus, daemon, auth browser) that are not unit-testable.
-          # WebRTC files are excluded: deprecated, slated for removal in 0.9.0.
           go test -race -coverprofile=coverage-core.out -covermode=atomic \
             ./internal/engine/... \
             ./internal/agent/...
-          # Strip webrtc lines from the profile before computing the threshold.
-          grep -v '/internal/engine/webrtc' coverage-core.out > coverage-core-filtered.out
-          COVERAGE=$(go tool cover -func=coverage-core-filtered.out | grep ^total | awk '{print $3}' | tr -d '%')
-          echo "Coverage on engine+agent (excluding webrtc): ${COVERAGE}%"
+          COVERAGE=$(go tool cover -func=coverage-core.out | grep ^total | awk '{print $3}' | tr -d '%')
+          echo "Coverage on engine+agent: ${COVERAGE}%"
           python3 -c "
           coverage = float('${COVERAGE}')
           threshold = 50.0