fix: blossom v4 config schema, container-internal blossom URL, e2e suite

- blossom-server 4.4.1 expects rules nested under storage: — the top-level
  rules list was ignored, leaving an empty ruleset that rejected all uploads
- podpuddle now verifies blobs and uploads recordings via BLOSSOM_URL_INTERNAL
  (http://blossom:3000) while feeds keep the browser-facing URL; unreachable
  blossom now returns 502 instead of a 500
- mediamtx: fix deprecated allow-origin params, disable MoQ
- scripts/e2e.mjs: 14 API checks (login, replay/URL rejection, upload,
  episode, feed, stream keys, mediamtx auth) — all green, plus verified
  live: RTMP publish with key → HLS 200, wrong key refused, status
  planned→live→ended via poller, recording remuxed + published as episode,
  feed XML well-formed with 2 items

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

mediamtx/mediamtx.yml

@@ -18,6 +18,7 @@ authHTTPExclude:
 # ---- protocols -----------------------------------------------------------
 rtsp: no
 srt: no
+moq: no
 
 rtmp: yes
 rtmpAddress: :1935
@@ -26,12 +27,12 @@ hls: yes
 hlsAddress: :8888
 hlsVariant: lowLatency
 hlsAlwaysRemux: yes
-hlsAllowOrigin: "*"
+hlsAllowOrigins: ["*"]
 
 webrtc: yes
 webrtcAddress: :8889
 webrtcLocalUDPAddress: :8189
-webrtcAllowOrigin: "*"
+webrtcAllowOrigins: ["*"]
 
 # ---- recording -----------------------------------------------------------
 pathDefaults: