Fix renderer selection and add AirPlay 2 pairing

[vyrti]

Summary

• always reopen renderer selection for each dashboard cast action
• discover AirPlay URL-video receivers and add PIN pairing with persistent protected credentials
• implement encrypted AirPlay 2 capability negotiation, setup, event, timing, feedback, playback, and control sessions
• preserve safe media extensions in cast URLs for receiver-side format selection
• support AirPlay-native MP4/M4V, MOV, HLS, and MPEG-TS media validation
• report an actionable fallback when a receiver rejects the current AirPlay 2 video negotiation

Hardware findings

The tested Sony completes pairing and encrypted session setup, but rejects /play with an empty 404 before requesting either a local MP4 or Apple HLS sample. This isolates the remaining compatibility gap to AirPlay video session negotiation rather than container or codec validation.

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace