harden: relay timeouts, DNS resolver reuse, cache hygiene + frontend polish

Server (relay/SSRF):
- Bound connect+TLS+request under CONNECT_TIMEOUT and body download under
  BODY_TIMEOUT so a stalling upstream can't pin a relay permit indefinitely
- Add inbound header_read_timeout to defeat slow-loris connections
- Allowlist relayed Content-Type (fall back to octet-stream) to block
  content-confusion from attacker-controlled stream origins
- Reuse one DNS resolver process-wide instead of rebuilding it per request
  (restores hickory's DNS cache; drops per-segment resolver setup)
- Probe cache: random per-process hash seed (DefaultHasher was deterministic)
  + bounded growth with expired-entry eviction
- Real Ctrl-C handler for a clean shutdown (honours the banner)
- Collapse the wrap_raw no-op alias into wrap

Frontend:
- Guide: visible focus ring tracking arrow-key navigation
- Player: buffering/tuning indicator while <video> is stalled
- prefers-contrast: more pass (lifts --ink-dim to meet WCAG AA)
- Service worker: date-stamped cache names so shell updates propagate

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/sw.js

@@ -9,8 +9,11 @@
 // NEVER cached — the relay marks them no-store and we bypass them here, so the SW
 // is the sole freshness authority for metadata only.
 
-const SHELL = 'orb-shell-v1';
-const DATA = 'orb-data-v1';
+// Bump these on every shell change so returning visitors actually receive the
+// new assets — a static 'v1' name would serve stale JS/CSS indefinitely. The
+// activate handler deletes any cache whose name isn't in this current pair.
+const SHELL = 'orb-shell-20260615';
+const DATA = 'orb-data-20260615';
 
 const SHELL_ASSETS = [
   '/', '/index.html', '/styles.css',