0.2.2 + 0.3.0: remote threading fix, phone-first onboarding, ten-foot settings, self-healing errors, in-app updater, group filter

Squashed history rewrite: earlier revisions of the docs carried private
hostnames; placeholders throughout history now.

- Fix phone remote threading (welcome/get_state/broadcast) — remote connects
  and mirrors channels, Now/Next, favorites
- Phone-first onboarding (ADR-0007): one QR, server URL + IdP login on the
  phone (closes #11)
- Ten-foot settings + Erweitert sub-screen (closes #14), TvTextField D-pad
  focus fix (closes #9)
- EPG grid envelope parsing, Now/Next live (closes #10)
- Self-healing error states (closes #13), in-app updater (closes #12)
- Channel group filter chips fed by Dispatcharr groups

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/adr/0006-viewer-admin-domain-split.md

@@ -0,0 +1,20 @@
+---
+status: accepted
+---
+
+# Domain split: nodecast as family viewer, Dispatcharr as engine
+
+The family needs comfortable SSO viewing in the browser; Dispatcharr's web UI
+is an admin surface, not a viewer. We reinstated nodecast-tv as the browser
+frontend on <viewer-host> (it already has an OIDC login and in-browser
+transcoding) — but demoted to a pure viewer with exactly one source:
+Dispatcharr's M3U/EPG output. Dispatcharr stays the engine (sources,
+aggregation, failover, per-user favorites for the TV app) and moved to
+<admin-host> (internal admin) plus api.<viewer-host> (external API
+for Castarr sticks outside the LAN; the OIDC redirect URI is derived from the
+request host, all three hosts are registered at the IdP).
+
+Access control lives on the IdP, not in app code: an Authentik group policy
+binding (`adult`) on the nodecast, Dispatcharr and Castarr applications gates
+both browser login and the device flow. The fork's OIDC_REQUIRED_GROUP knob
+stays unused.

docs/adr/0007-onboarding-via-remote.md

@@ -0,0 +1,13 @@
+---
+status: accepted
+---
+
+# Onboarding runs on the phone through the TV's own pairing server
+
+Nobody should ever type on a TV. Instead of baking a server URL into the APK
+(rejected: publishes private infrastructure in a public artifact) or on-TV
+text entry (rejected: D-pad typing), first-run setup reuses the embedded
+remote-control server: the TV shows one QR, the phone opens the TV-served web
+app, and server URL plus IdP login (device-flow link opened directly on the
+phone) happen there. Requires phone and TV on the same LAN — acceptable, since
+the remote control has the same requirement by design.