feat(core,stream,meta,app,android,cli): sign in to Proton and sync watch history

A Proton account is now optional alongside public links. Signing in (password,
then a second-factor code and a mailbox password where the account has them;
a CAPTCHA gate is solved in the Android app) stores one session blob in the OS
credential store under `proton-account`, writing back every refreshed token
since refresh tokens are single-use. With an account, folders of the viewer's
own Drive — My Files, other devices, shared with me — can be added as shares
through the same `ShareClient` surface as a public link.

Watch history syncs through a `proton-stream` device in that Drive: one
`watch-history/<installation>.json` per installation, so no two devices ever
write the same file. Each sync reads the others and merges per episode, newer
`updated_at` wins, with a deterministic tie-break. It runs at launch, after
sign-in, whenever the player closes and every five minutes. A session that can
no longer refresh signs the app out instead of failing on every launch.

The CLI gains `login`, `logout`, `account`, `browse` and `sync`.

Also in this change:
- Android offline downloads no longer look stuck (B64): two transfer at once,
  through a copy stream with no read-ahead, with a smoothed transfer rate.
- Choosing a metadata match by hand now enriches the title too, instead of
  keeping the old match's episodes and artwork.

The catalog schema is unchanged.

Cargo.lock

@@ -4376,6 +4376,7 @@ name = "pstr-android"
 version = "1.1.3"
 dependencies = [
  "android_logger",
+ "futures",
  "jni 0.21.1",
  "log",
  "parking_lot",
@@ -4428,6 +4429,7 @@ version = "1.1.3"
 dependencies = [
  "anyhow",
  "clap",
+ "parking_lot",
  "proton-drive-rs",
  "proton-sdk",
  "pstr-core",
@@ -4446,7 +4448,9 @@ version = "1.1.3"
 dependencies = [
  "directories",
  "futures",
+ "getrandom 0.3.4",
  "keyring",
+ "parking_lot",
  "proton-drive-rs",
  "proton-sdk",
  "rusqlite",