Federation: read-only browsing of a peer instance's library (3.5)

Configure peers as [[remote]] entries (name, url, optional password) and
browse their libraries from this instance, read-only.

- remote.rs: RemoteClient (blocking reqwest + rustls + cookie jar). Fetches
  the peer's /api/library, logging in first if the peer has a password and
  retrying on a 401. Media is not proxied: the library JSON's media URLs
  (/files/, /music-files/, /api/transcode/, /api/sub-vtt/) are rewritten to
  absolute peer URLs with the peer's read-only feed token appended, so video
  streams straight from the peer to the browser/mpv while only the small JSON
  passes through us.
- web.rs: auth_middleware now also accepts the feed token for GET
  /api/transcode/ and /api/sub-vtt/ (read-only media, same class as /files/),
  so a transcoded peer streams remotely. New GET /api/remotes and
  /api/remotes/:id/library (the RemoteClient runs under spawn_blocking).
- web UI: a 🌐 Remotes sidebar switcher; remote mode is read-only (hides the
  download bar + per-card mutating actions, keeps Play).
- desktop: a 🌐 Remotes screen that fetches a peer's library off-thread and
  plays via mpv on the tokenized URL.
- config.rs: [[remote]] section list; reqwest dep added (rustls/blocking/
  cookies, no system OpenSSL).

Verified end-to-end against a second local instance, including a transcoded
stream returning HTTP 200 via the token. ROADMAP 3.5 + CLAUDE.md updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/config.rs

@@ -24,6 +24,25 @@ pub struct Config {
     pub subtitles: SubtitlesSection,
     #[serde(default)]
     pub convert: ConvertSection,
+    /// Federation: other yt-offline instances whose libraries can be browsed
+    /// read-only from this one (see [`crate::remote`]). Each is a
+    /// `[[remote]]` table in config.toml.
+    #[serde(default, rename = "remote")]
+    pub remotes: Vec<RemoteSection>,
+}
+
+/// One `[[remote]]` entry — a peer yt-offline instance to browse read-only.
+#[derive(Debug, Serialize, Deserialize, Clone)]
+pub struct RemoteSection {
+    /// Display name in the UI's remote switcher.
+    pub name: String,
+    /// Base URL of the peer's web server, e.g. `http://woofbox:8081` or
+    /// `https://archive.example`. No trailing slash needed.
+    pub url: String,
+    /// Password for the peer, if it has one set. `None`/absent = open peer
+    /// (e.g. bound to a trusted tailnet). Stored plaintext like `cookies`.
+    #[serde(default)]
+    pub password: Option<String>,
 }
 
 /// `[convert]` table — global post-download format-conversion defaults.
@@ -289,6 +308,7 @@ impl Config {
             plex: PlexSection::default(),
             subtitles: SubtitlesSection::default(),
             convert: ConvertSection::default(),
+            remotes: Vec::new(),
         }
     }
 }