P6: remote video and audio play through the proxy

- The media proxy streams ranged requests from the origin (passing the range on, never caching), downloads and caches
  whole files otherwise, and serves cached files with range support. A PeerTube video is never fetched whole for one
  viewer, and clients still never contact the remote host.
- PeerTube's fragmented MP4 files inside an HLS entry are read as variants, so HLS-only instances play too.
- A remote Video or Audio post becomes one playable Mastodon attachment: the best MP4 up to 720p that carries both
  sound and picture, with its poster and duration; the card is kept only when nothing is playable.
- nginx: /media/proxy/ with proxy_buffering off and a 600 s read timeout (applied on the box, with a backup).

Checked live: a GoToSocial image through the proxy answers 206 with exactly the asked range when streamed, 200 when
cached, and 206 with the right Content-Range from the cache.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Api/Mastodon/Controllers/MediaController.cs

@@ -60,13 +60,38 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		[HttpGet("/media/proxy/{signature}/{encoded}"), AllowAnonymous, ApiExplorerSettings(IgnoreApi = true)]
 		public async Task<IActionResult> Proxy(string signature, string encoded, CancellationToken token)
 		{
-			var (path, contentType) = await _proxy.Fetch(signature, encoded, token);
-			if (path == default)
+			var url = _proxy.Verified(signature, encoded);
+			if (url == default)
 				return NotFound();
 			Response.Headers["X-Content-Type-Options"] = "nosniff";
 			Response.Headers["Content-Security-Policy"] = "default-src 'none'; sandbox";
 			Response.Headers["Cache-Control"] = "public, max-age=604800";
-			return PhysicalFile(path, contentType);
+			if (_proxy.Cached(url) is { Path: not null } cached)
+				return PhysicalFile(cached.Path, cached.ContentType, enableRangeProcessing: true);
+			if (Request.Headers.Range.Count == 0)
+			{
+				var (path, contentType) = await _proxy.Fetch(signature, encoded, token);
+				if (path != default)
+					return PhysicalFile(path, contentType, enableRangeProcessing: true);
+			}
+			return await Stream(url, token);
+		}
+
+		async Task<IActionResult> Stream(string url, CancellationToken token)
+		{
+			var range = System.Net.Http.Headers.RangeHeaderValue.TryParse(Request.Headers.Range.ToString(), out var asked) ? asked : default;
+			using var upstream = await _proxy.Open(url, range, token);
+			if (upstream == default)
+				return NotFound();
+			Response.StatusCode = (int)upstream.StatusCode;
+			Response.ContentType = upstream.Content.Headers.ContentType?.ToString() ?? "application/octet-stream";
+			if (upstream.Content.Headers.ContentLength is { } length)
+				Response.ContentLength = length;
+			if (upstream.Content.Headers.ContentRange is { } contentRange)
+				Response.Headers.ContentRange = contentRange.ToString();
+			Response.Headers.AcceptRanges = "bytes";
+			await upstream.Content.CopyToAsync(Response.Body, token);
+			return new EmptyResult();
 		}
 
 		object View(MediaAttachment attachment) => new