feat: add native Windows broadcaster and live score modules

- streamer/windows: vash-broadcast.exe (setup/login/start/stop/status/doctor)
  with per-instance OBS, tosu and FFmpeg, a supervised worker, OCR room
  selection and OBS scene reconciliation; built and tested on Linux only
- streamer/relay.ts shared with Vash TV; Cloudflare Access proxy for dev/staging
- worker status validation and live score helpers for the site
- STREAMING_HANDOFF.md and streamer/ALPHA_TEST.md record what is unverified

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

streamer/windows/control.ts

@@ -0,0 +1,44 @@
+/**
+ * The running worker answers on 127.0.0.1:<control port> so the CLI (in an
+ * SSH session) can ask for its status, stop it, or take snapshots. The token
+ * changes every run and is kept in runtime.json in the user's own profile.
+ */
+import { readJson } from './config';
+
+export interface Runtime {
+	pid: number;
+	watchdogPid: number | null;
+	port: number;
+	token: string;
+	startedAt: string;
+	version: string;
+}
+
+export async function callWorker<T>(
+	runtimePath: string,
+	path: string,
+	init: { method?: string; timeoutMs?: number } = {}
+): Promise<T | null> {
+	const runtime = await readJson<Runtime>(runtimePath);
+	if (!runtime) return null;
+	try {
+		const response = await fetch(`http://127.0.0.1:${runtime.port}${path}`, {
+			method: init.method ?? 'GET',
+			headers: { 'x-vash-token': runtime.token },
+			signal: AbortSignal.timeout(init.timeoutMs ?? 4000)
+		});
+		if (!response.ok) return null;
+		return (await response.json()) as T;
+	} catch {
+		return null;
+	}
+}
+
+export function authorized(request: Request, token: string) {
+	const given = request.headers.get('x-vash-token') ?? '';
+	if (given.length !== token.length) return false;
+	let diff = 0;
+	for (let index = 0; index < token.length; index++)
+		diff |= given.charCodeAt(index) ^ token.charCodeAt(index);
+	return diff === 0;
+}