fix: blossom v4 config schema, container-internal blossom URL, e2e suite

- blossom-server 4.4.1 expects rules nested under storage: — the top-level
  rules list was ignored, leaving an empty ruleset that rejected all uploads
- podpuddle now verifies blobs and uploads recordings via BLOSSOM_URL_INTERNAL
  (http://blossom:3000) while feeds keep the browser-facing URL; unreachable
  blossom now returns 502 instead of a 500
- mediamtx: fix deprecated allow-origin params, disable MoQ
- scripts/e2e.mjs: 14 API checks (login, replay/URL rejection, upload,
  episode, feed, stream keys, mediamtx auth) — all green, plus verified
  live: RTMP publish with key → HLS 200, wrong key refused, status
  planned→live→ended via poller, recording remuxed + published as episode,
  feed XML well-formed with 2 items

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

blossom/config.yml

@@ -1,5 +1,5 @@
-# blossom-server configuration for podpuddle.
-# Uploads require a signed nostr auth event (BUD-01/BUD-02, kind 24242);
+# blossom-server (v4.x) configuration for podpuddle.
+# Uploads require a signed nostr auth event (BUD-02, kind 24242);
 # reads are public so podcast apps can fetch enclosures.
 
 publicDomain: ""
@@ -22,22 +22,22 @@ storage:
   local:
     dir: ./data/blobs
   removeWhenNoOwners: false
+  # NOTE: "expiration" is time since a blob was last accessed — unaccessed
+  # blobs get pruned after this. Podcast media should effectively never
+  # expire, so keep this long.
+  rules:
+    - type: "*"
+      expiration: 10 years
 
 upload:
   enabled: true
   requireAuth: true
   requirePubkeyInRule: false
 
-media:
-  enabled: false
-
 list:
   requireAuth: false
   allowListOthers: true
 
 tor:
   enabled: false
-
-rules:
-  - type: "*"
-    expiration: 10 years
+  proxy: ""