fix: restore playback via AllAnime client-crypto bootstrap

[ssnake]

Problem

ani-cli <anything> fails at playback with:

ani-cli: 253: Illegal number: 0x

The source site (AllAnime / mkissa) replaced its static key material — a 64‑hex mask in the JS bundle plus partB in the landing HTML — with a runtime client‑crypto bootstrap handshake. Both scraped values are now empty, so the XOR loop in fetch_keys evaluated 0x and aborted.

Why the fix looks the way it does

The new key derivation only exists after the site's obfuscated, self‑rotating JavaScript runs (a runtime string‑array rotation defeats static grep/sed extraction, and the request‑signing proof x-aa-boot is an HMAC chain over a build‑id‑derived mask). It cannot be reproduced in POSIX shell.

fetch_keys now runs the site's own crypto in a JS runtime to obtain the AES‑256 key, epoch, build id and content lane:

• deno (preferred) — run with --allow-net, which confines the executed site code to network access only (no filesystem/process/env).
• node ≥ 20 — fallback.

The embedded helper downloads the crypto chunk, neutralises its ESM imports, evaluates it in a stubbed browser‑like sandbox, and calls the site's own bootstrap entrypoint. It emits KEY/EPOCH/BUILDID/LANE, and fetch_keys dies with a clear message if anything fails (no more cryptic crash).

Protocol changes the new backend requires

• get_aa_req payload is now {v,ts,epoch,buildId,qh,k}; IV = SHA‑256(epoch:buildId:qh:ts:lane)[:12].
• get_episode_url request extensions include "k":<lane> and the request sends the x-build-id header.
• The persisted query hash is unchanged.

New dependency (please review)

This adds a deno or node runtime requirement and executes the source site's JavaScript. That is a real departure from ani-cli's pure‑POSIX‑shell design, and I'm flagging it explicitly for discussion — but the site's key handshake is deliberately non‑reproducible in shell, so some form of JS execution is currently the only way to restore playback. deno --allow-net keeps the executed remote code sandboxed to the network.

Verification

End‑to‑end against the live site: search → key derivation → source decryption → link resolution all succeed, and a real playable .mp4 URL is returned (tested via ANI_CLI_PLAYER=debug). Helper produces identical output under both node and deno. sh -n and bash -n pass.

[radumihai1]

works, tested with WSL Ubuntu 26.04
you have to install deno with:
curl -fsSL https://deno.land/install.sh | sh
then:
echo 'export DENO_INSTALL="$HOME/.deno"' >> ~/.bashrc
echo 'export PATH="$DENO_INSTALL/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc

[port19x]

I will leave this open as a potential fix, despite it duplicating the more native implementation in #1829

[port19x]

closing this since v5 is now released.
Thanks for providing a stopgap solution