feat(stream)!: retire WebRTC, HLS-only, bump 0.9.4

Drops the custom WebRTC DataChannel pipeline + pion deps + WSS signaling
client + wire framing. Every in-browser playback now uses HLS over HTTP
from the daemon (Tailscale/LAN/UPnP). Browser P2P never re-enabled.

Wire renames (incompatible with web < 2026-05-26): agent.WebRTCSession
=> agent.StreamSession, SyncResponse.WebRTCSessions (JSON: webrtcSessions)
=> StreamSessions (JSON: streamSessions). MIN_AGENT_VERSION is bumped
to 0.9.4 on the web side so older agents see an upgrade card.

Also fixes the libx264 'VBV bitrate > level limit' abort by clamping
the encoder bitrate to the effective output height instead of the
requested label (carried over from the prior 0.9.3 unreleased work).

The seed_file vertical (mode=seed_file handler + engine.SeedFile) was
retired with the in-browser P2P player. [downloads.webrtc] config block
deleted; existing TOML files with the section still parse fine.

internal/engine/torrent.go

@@ -16,7 +16,6 @@ import (
 	alog "github.com/anacrolix/log"
 	"github.com/anacrolix/torrent"
 	"github.com/anacrolix/torrent/storage"
-	"github.com/pion/webrtc/v4"
 	"github.com/torrentclaw/unarr/internal/config"
 	"github.com/torrentclaw/unarr/internal/vpn"
 	"golang.org/x/term"
@@ -73,14 +72,6 @@ type TorrentConfig struct {
 	SeedRatio       float64       // target seed ratio (default 0, meaning seed until SeedTime)
 	SeedTime        time.Duration // min seed time after completion (default 0)
 
-	// WebRTC peer (WebTorrent protocol) for browser ↔ unarr P2P streaming.
-	// When enabled, anacrolix/torrent's built-in webtorrent package handles
-	// the WSS signaling + WebRTC data channels. Implies upload allowed for
-	// every torrent in the client (browsers can't pull pieces otherwise).
-	WebRTCEnabled  bool
-	WebRTCTrackers []string           // wss://… signaling trackers added to every magnet
-	ICEServers     []webrtc.ICEServer // STUN + TURN servers for NAT traversal
-
 	// VPNTunnel, when set, split-tunnels the torrent client's peer + tracker
 	// traffic through an in-process userspace WireGuard tunnel (managed-VPN
 	// add-on). nil = downloads in the clear. Brought up by the daemon.
@@ -111,26 +102,11 @@ func NewTorrentDownloader(cfg TorrentConfig) (*TorrentDownloader, error) {
 	tcfg := torrent.NewDefaultClientConfig()
 	tcfg.DataDir = cfg.DataDir
 	tcfg.Seed = cfg.SeedEnabled
-	// WebRTC peers (browsers) can only pull pieces from us if upload is
-	// enabled. We honour SeedEnabled for the long-tail seed-after-complete
-	// behaviour but unconditionally allow upload while WebRTC is on so an
-	// active download can still serve to a watching browser.
-	tcfg.NoUpload = !cfg.SeedEnabled && !cfg.WebRTCEnabled
-	tcfg.Logger = alog.Default.FilterLevel(alog.Warning) // bumped from Critical for WebRTC peer + tracker announce visibility
+	tcfg.NoUpload = !cfg.SeedEnabled
+	tcfg.Logger = alog.Default.FilterLevel(alog.Warning)
 
-	// WebRTC / WebTorrent peer: anacrolix auto-routes ws://+wss:// trackers
-	// to the bundled webtorrent.TrackerClient. We only need to populate the
-	// ICE server list so the SDP offers we send carry usable candidates.
-	if cfg.WebRTCEnabled {
-		tcfg.DisableWebtorrent = false
-		if len(cfg.ICEServers) > 0 {
-			tcfg.ICEServerList = cfg.ICEServers
-		}
-		log.Printf("[torrent] WebRTC peer enabled (trackers=%d ice_servers=%d)",
-			len(cfg.WebRTCTrackers), len(cfg.ICEServers))
-	} else {
-		tcfg.DisableWebtorrent = true
-	}
+	// No browser-facing WebTorrent peer; daemon never seeds via WSS.
+	tcfg.DisableWebtorrent = true
 
 	// --- Performance optimizations ---
 
@@ -657,30 +633,17 @@ func (d *TorrentDownloader) selectFiles(t *torrent.Torrent, taskID string) (tota
 	return totalBytes, fileName
 }
 
-// buildMagnet composes a magnet URI for the info hash. extraTrackers (e.g.
-// wss://… for WebRTC peer signaling) are prepended so anacrolix's
-// webtorrent.TrackerClient picks them up first; the static UDP list
-// follows. Empty / whitespace entries in extraTrackers are skipped.
-func buildMagnet(infoHash string, extraTrackers ...string) string {
+// buildMagnet composes a magnet URI for the info hash with the static
+// tracker list.
+func buildMagnet(infoHash string) string {
 	params := []string{"xt=urn:btih:" + infoHash}
-	for _, t := range extraTrackers {
-		t = strings.TrimSpace(t)
-		if t == "" {
-			continue
-		}
-		params = append(params, "tr="+url.QueryEscape(t))
-	}
 	for _, tracker := range defaultTrackers {
 		params = append(params, "tr="+url.QueryEscape(tracker))
 	}
 	return "magnet:?" + strings.Join(params, "&")
 }
 
-// buildMagnet on the downloader injects its WebRTC trackers when enabled.
 func (d *TorrentDownloader) buildMagnet(infoHash string) string {
-	if d != nil && d.cfg.WebRTCEnabled {
-		return buildMagnet(infoHash, d.cfg.WebRTCTrackers...)
-	}
 	return buildMagnet(infoHash)
 }