feat(live): polish — ended-state, chat, viewer actions, Private option

Restores the live streaming controllers / views / model from the
pre-audit WIP that got stashed on 2026-10-21, then applies the Phase 6
polish items:

## /live/new form
Add a Private visibility option that mirrors the upload modal's
wording — "Only you can see this stream. Perfect for testing without
an audience." Validator in LiveStreamController@store now permits
public|unlisted|private (was public|unlisted).

## Watch page ended-state
When the stream status is "ended", the overlay is a solid "Stream
ended" card showing the stream's duration (started_at → ended_at)
and, when a recording was published, a Watch Replay CTA linking to
the saved video. Previously an ended stream showed the generic
"Waiting for the broadcast to start" placeholder forever.

## Channel name link
The uploader's name in the meta row is now a real <a href> to the
channel page.

## Viewer action row
Subscribe + Share buttons below the player, visible to anyone except
the owner. Subscribe for guests uses the Phase 7 ?intended= pattern
so after sign-in they land back on the stream.

## Live chat (DB-backed polling)
New live_chat_messages table (migration 2026_10_21_000003). Viewers
GET /live/{stream}/chat?since=N every 3 seconds; signed-in users POST
to the same path (rate-limited at 60/min). Guests see the panel in
read-only mode with a "Sign in to chat" placeholder.

Private streams reject chat for anyone but the owner (404). Non-live
status rejects chat sends (422). Author name is snapshotted at post
time so a renamed account's old messages keep the name they used.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

routes/web.php

@@ -200,6 +200,30 @@ Route::get('/channel/{username}/videos/more', [UserController::class, 'channelVi
 // in UserController::channel() to prefer a dedicated `handle` column.
 // The {handle} segment must be url-encoded (e.g. /%40alice) OR plain `@alice`
 // — Laravel's router accepts both because `@` is allowed in URI path segments.
+// ─── Live streaming ─────────────────────────────────────
+use App\Http\Controllers\LiveAuthController;
+use App\Http\Controllers\LiveStreamController;
+
+Route::get('/live', [LiveStreamController::class, 'index'])->name('live.index');
+Route::get('/live/new', [LiveStreamController::class, 'create'])->name('live.create');
+Route::post('/live', [LiveStreamController::class, 'store'])->name('live.store')->middleware('throttle:10,1');
+
+Route::get('/live/{stream}/broadcast', [LiveStreamController::class, 'broadcast'])->name('live.broadcast');
+Route::post('/live/{stream}/token', [LiveStreamController::class, 'token'])->name('live.token')->middleware('throttle:30,1');
+Route::post('/live/{stream}/stop', [LiveStreamController::class, 'stop'])->name('live.stop')->middleware('throttle:30,1');
+
+Route::get('/live/{stream}', [LiveStreamController::class, 'watch'])->name('live.watch');
+Route::get('/live/{stream}/status', [LiveStreamController::class, 'status'])->name('live.status')->middleware('throttle:120,1');
+
+// Live chat — polling by viewers, send by signed-in users (rate-limited).
+Route::get('/live/{stream}/chat',  [LiveStreamController::class, 'chatPoll'])
+    ->name('live.chat.poll')->middleware('throttle:120,1');
+Route::post('/live/{stream}/chat', [LiveStreamController::class, 'chatSend'])
+    ->name('live.chat.send')->middleware('throttle:60,1');
+
+Route::post('/api/live/auth', [LiveAuthController::class, 'authenticate'])->withoutMiddleware([\App\Http\Middleware\VerifyCsrfToken::class]);
+Route::post('/api/live/hook', [LiveAuthController::class, 'hook'])->withoutMiddleware([\App\Http\Middleware\VerifyCsrfToken::class]);
+
 Route::get('/@{handle}', [UserController::class, 'channel'])
     ->where('handle', '[A-Za-z0-9][A-Za-z0-9._-]*')
     ->name('channel.handle');