VideoController constructor applied auth middleware to all methods
not in the except list. playerData was missing, causing guest
requests to get 401 → SPA fallback to window.location.href → page refresh.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2c0888088d