proxyUrl() in player.blade.php listed aniziumserver.sbs/site/com in
DIRECT_CORS_HOSTS, so it unwrapped the server's /stream/proxy URLs and
tried loading them directly from the browser. That CORS assumption is
no longer true (confirmed via browser console), which silently undid
the PlayerController fix from the previous commit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
videoSourcesData (quality/dub failover list) wasn't routed through
stream.proxy, so switching quality/dub hit Anizium's CDN directly and
got blocked by CORS. aniziumserver.sbs was also wrongly whitelisted as
CORS-safe in isOwn — it isn't, per browser console evidence.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
