fix(alliance): bounded SETUP negotiation, login recovery and endpoint trust

[zortos293]

Merges current dev and expands this branch beyond the original SETUP investigation with the confirmed fixes from the alliance support audit (issue #951, nightly v1.0.2-nightly.623.1).

Video SETUP negotiation (original scope, kept)

• Tries a bounded set of control-URI and Transport forms within one shared request budget, keeping the official first request. A successful response must still supply a usable server-authored video endpoint; nothing is invented.
• Emits redacted video-setup and video-setup-transport diagnostics on rejected 200 responses: status, field presence, source/port shape, quoting and key spacing. Input capped at 2 KiB and 16 fields; raw values, addresses and credentials are never logged.
• This remains not a verified fix for the reported partner failure: the exact returned Transport shape is still unknown. The next step is one diagnostic capture from the affected account, as documented in the new acceptance section.

Qt login, account and recovery fixes

• Hard provider-list RPC failures now enter the same bounded degraded/retry state as degraded envelopes (3 retries plus manual Refresh on desktop and console) instead of leaving an empty list with no recovery.
• Expired, denied or failed device logins clear the stale challenge so retry starts a new attempt; cancelling an in-progress add-account login returns to idle instead of sticking on the waiting UI.
• Adding another account is an explicit flow that works while signed in and navigates home on completion; failed profile switches, removals and logout-all now show their error on the account page without changing the active account.
• Exhausted missing-video-peer (all SETUP forms failed to yield an endpoint) and nvst-legacy-transport-unsupported are terminal: no more reclaiming the same seat in a loop. The original error and seat are preserved for explicit retry or stop; transient failures keep automatic recovery.

RTSPS endpoint handling

• Fixes IPv6 literal endpoints (single bracket pair preserved for trust check, WSS authority and RTSP target) and closes newly reachable trust gaps: IPv6 ULA/multicast and IPv4-mapped private addresses are rejected under the existing policy.

Docs

• New docs/qt-acceptance.md section for alliance login/negotiation verification, including what to capture from a still-failing partner. docs/core-protocol.md records the terminal-error recovery contract.

Validation

• Native streamer workspace: 875 passed, 0 failed, 9 ignored; strict Clippy and cargo fmt --check pass.
• Full Qt suite: 381/381 pass, including 15 new orchestration regression cases (bounded provider retry, failed-login restart, add-account completion and cancel, visible account errors, terminal negotiation without seat reclaim).
• npm run locales:check passes; touched QML files pass qmlformat; git diff --check clean.
• Rendered the changed sign-in UI with the existing alliance fixture (Xvfb/OpenGL for desktop, offscreen for console):

Live verification with an affected partner account (login, catalog, first frame, stop, reconnect) is still required before claiming the compatibility issue fixed; docs/qt-nightly-release.md keeps its alliance warning until then.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: b9df1368-0af5-4f11-8aa2-bd8695c098e5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[capy-ai]

The latest live test still fails. The new trace shows the first two relative SETUP requests return 200 with Transport and ping metadata present, but video_peer_valid=false; the absolute/client-port alternatives return 400. This points to rejection of the returned Transport data, not failure to find an accepted URI. The exported diagnostics omit the Transport value, so the precise parse failure is not established yet. This PR is not a verified fix for the affected Alliance session despite green CI; investigation needs the actual response from that session.