fix(recording): validate Twitch auth and fall back to anonymous H.264

[Serph91P]

Summary

• Live-validate Twitch credentials before authenticated recording; use token-free anonymous H.264 when credentials are missing, rejected or unverifiable.
• Preserve stored credentials on transient validation failures and invalidate only the matching stored version after definitive rejection.
• Allow exactly one classified authentication retry before recording data exists, including rejection after the bounded startup observation window.

Late-auth review correction

The existing completion monitor now owns authentication rejection after the startup window, without extending that window. The retry keeps the output path and proxy/direct route, fences process ownership and replaces the existing segment process rather than creating another segment or notification. The monitor releases the rotation lock before awaiting the replacement's completion.

Regression coverage exercises the real monitor task: crossing the startup deadline, existing data, unrelated errors, lost ownership, duplicate notifications and a second authentication failure from the anonymous replacement. Handoff state does not retain the resolved bearer token.

Verification

Candidate: 5b17c7bfd73f5f95762dfad789218cc2ad89da42, against develop base c679a1b577e04ccbca1c19689ab19d92f5a214d1.

• New crossing-deadline regression fails against the exact previous implementation and passes with this correction.
• Backend: 476 passed, 6 skipped, confirmed again by a fresh hermes verify --phase test run.
• Focused authentication suite: 27 passed.
• Canonical Ruff lint/format, bounded mypy target, changed-test lint and Bandit gate passed.
• New exact-head CI is blocked: the unchanged videos-filters-long-450 visual screenshot failed again (65 browser tests passed, 1 failed); Integration Tests were skipped. Failure screenshots/diff/trace are now captured by the existing artifact step. The previous head's green CI is not approval for this head.
• Previous Docker/migration/live anonymous H.264/AAC evidence remains historical; no new live-recording smoke claim is made for this correction.

Review status

Draft pending fresh independent Technical and Security review of this exact head and all required CI checks. Earlier verdicts are superseded, not waived. No frontend reference image or screenshot tolerance changed. Merge, release and deployment are not part of this PR handoff.

Fixes #834