fix(streaming): reliable disconnect + mandatory stream password

Disconnect:
- Server-side heartbeat ping/pong every 10s with 25s timeout
- Detects and cleans up dead connections (browser closed, network lost)
- ws.terminate() on heartbeat timeout triggers handleDisconnect

Password:
- Stream password is mandatory (server rejects start_broadcast without)
- Password stored server-side, never sent to clients
- Viewers must enter password via modal before joining
- Lock icon on tiles, WRONG_PASSWORD error shown in modal

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/src/plugins/streaming/streaming.css

@@ -324,3 +324,72 @@
   border: 2px solid var(--danger);
   border-bottom: none;
 }
+
+/* ── Password input in topbar ── */
+.stream-input-password {
+  width: 140px;
+}
+
+/* ── Lock icon on tile ── */
+.stream-tile-lock {
+  position: absolute;
+  bottom: 8px;
+  right: 8px;
+  font-size: 16px;
+  opacity: 0.6;
+}
+
+/* ── Password modal ── */
+.stream-pw-overlay {
+  position: fixed;
+  inset: 0;
+  z-index: 1000;
+  background: rgba(0, 0, 0, 0.7);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+.stream-pw-modal {
+  background: var(--bg-secondary);
+  border-radius: var(--radius-lg);
+  padding: 24px;
+  width: 340px;
+  max-width: 90vw;
+}
+.stream-pw-modal h3 {
+  font-size: 16px;
+  font-weight: 600;
+  margin-bottom: 4px;
+}
+.stream-pw-modal p {
+  font-size: 13px;
+  color: var(--text-muted);
+  margin-bottom: 16px;
+}
+.stream-pw-modal .stream-input {
+  width: 100%;
+  margin-bottom: 12px;
+}
+.stream-pw-modal-error {
+  color: var(--danger);
+  font-size: 13px;
+  margin-bottom: 8px;
+}
+.stream-pw-actions {
+  display: flex;
+  gap: 8px;
+  justify-content: flex-end;
+}
+.stream-pw-cancel {
+  padding: 8px 16px;
+  border: 1px solid var(--bg-tertiary);
+  border-radius: var(--radius);
+  background: transparent;
+  color: var(--text-muted);
+  cursor: pointer;
+  font-size: 14px;
+}
+.stream-pw-cancel:hover {
+  color: var(--text-normal);
+  border-color: var(--text-faint);
+}