Merge main into dev

[kixelated]

Merges origin/main into dev. Most files merged cleanly; 13 conflicts were resolved, several of them semantic where main and dev touched the same code with diverging APIs.

Conflict resolutions

Rust

• Cargo.toml / Cargo.lock: kept dev's moq-hls crate and took main's released moq-json 0.0.4 bump. Regenerated Cargo.lock with cargo.
• rs/moq-relay/src/connection.rs: kept dev's conditional session builder (only sets the side the token grants, using the non-deprecated with_publisher/with_subscriber). Layered in main's credential-expiry handling, which needs the session bound mut so it can call session.close(...).
• rs/moq-boy/src/input.rs: kept main's moq-json Consumer command loop, adapted onto dev's track-subscribe API (broadcast.track("command")?.subscribe(None)?.await? yields the TrackSubscriber that moq_json::Consumer::new wants).
• rs/moq-native/tests/backend.rs: used the non-deprecated forms from each side: peer_identity().is_some() (main) + with_publisher (dev).

JS

• js/net/src/lite/origin.ts: dropped dev's stale 62-bit doc paragraph; the code (and the Rust Origin::random counterpart) caps the random id at 53 bits, which main's TEMPORARY note already documents.
• js/moq-boy/src/index.ts: kept main's Json.Producer command track, adapted onto dev's request API (req.accept() returns the Moq.TrackProducer the producer wraps).
• js/watch/* (the big ones): dev refactored watch into an input/output (Inputs/Readonlys/getter/readonlys) architecture while main added buffered-playback latency ranges (feat(watch): latency range with buffered playback #1620). Folded main's feature set into dev's architecture:
  • sync.ts: range Latency type + latencyBounds/latencyFromBounds, buffered/maxBuffer outputs, #runRange/#latencyCap/#setReference/reset, and the cap-aware received() logic, all routed through dev's input/#output.
  • decoder.ts: #consumerLatency driven by sync.output.maxBuffer, createAudioBuffer(..., buffered), ring.wait() backpressure, and reset().
  • backend.ts: reset() + #audioDecoder, exposed output.buffered.
  • element.ts: latency-min/latency-max attributes, latencyMin/latencyMax/reset() accessors, all read-modify-writing the element-owned controls.latency.
  • sync.test.ts + UI latency.ts/buffer-control.ts: updated to the merged .output surface and the buffered-aware latencyMin setters.

Test plan

• cargo check (incl. --tests) for moq-net, moq-relay, moq-boy, moq-native
• tsc --noEmit for js/watch, js/moq-boy, js/net, demo/web
• bun test in js/watch (78 pass, incl. the 6 new latency-range tests)
• Biome + rustfmt clean on all resolved files (a follow-up commit wraps the #runCommandTrack signature that biome flagged)
• cargo test -p moq-relay -p moq-boy: passes except the moq-relay smoke tests, which fail only in this sandbox because it has no IPv6 (Quinn(BindSocket(... "Address family not supported by protocol")) at the [::]:0 bind in shared test setup, before any merged logic runs). Not a merge regression; expected to pass on CI's runner.

(Written by Claude)