feat(stream)!: retire WebRTC, HLS-only, bump 0.9.4

Drops the custom WebRTC DataChannel pipeline + pion deps + WSS signaling
client + wire framing. Every in-browser playback now uses HLS over HTTP
from the daemon (Tailscale/LAN/UPnP). Browser P2P never re-enabled.

Wire renames (incompatible with web < 2026-05-26): agent.WebRTCSession
=> agent.StreamSession, SyncResponse.WebRTCSessions (JSON: webrtcSessions)
=> StreamSessions (JSON: streamSessions). MIN_AGENT_VERSION is bumped
to 0.9.4 on the web side so older agents see an upgrade card.

Also fixes the libx264 'VBV bitrate > level limit' abort by clamping
the encoder bitrate to the effective output height instead of the
requested label (carried over from the prior 0.9.3 unreleased work).

The seed_file vertical (mode=seed_file handler + engine.SeedFile) was
retired with the in-browser P2P player. [downloads.webrtc] config block
deleted; existing TOML files with the section still parse fine.

internal/cmd/download.go

@@ -114,9 +114,6 @@ func runDownloadWithDeps(input, method string, deps downloadDeps) error {
 		StallTimeout:    10 * time.Minute,
 		MaxTimeout:      0, // unlimited
 		SeedEnabled:     false,
-		WebRTCEnabled:   cfg.Download.WebRTC.Enabled,
-		WebRTCTrackers:  cfg.Download.WebRTC.Trackers,
-		ICEServers:      engine.BuildICEServers(cfg.Download.WebRTC),
 	})
 	if err != nil {
 		return fmt.Errorf("create downloader: %w", err)