feat(anikoto): add Anikoto provider

[itsmenewbie03]

Summary

Ports the working Anikoto Tachiyomi extension into Curd.

/filter?keyword=<query>&vrf=<token>
  → /watch/<slug>
  → /ajax/episode/list/<anime-id>?vrf=<token>
  → /ajax/server/list?servers=<episode-token>
  → /ajax/server?get=<server-token>
  → MegaPlay /stream/getSources?id=<media-id>
  → AES-256-CBC source decryption
  → HMAC-signed HLS master.m3u8

Included:

• Anikoto HTML search parsing with sub/dub availability.
• Port of the extension's Java-compatible VRF transform.
• Native server selection based on requested audio mode.
• MegaPlay media-page and getSources resolution.
• AES-CBC decryption with PKCS#7 validation.
• Extension-compatible HMAC stream signing.
• English external subtitle selection through StreamPlaybackHint.
• Generic Meta.NoPrefetch support because signed MegaPlay URLs expire after 90 seconds.
• Mocked regression tests and an opt-in live integration test.

Mapper servers, Mewcdn, and the Tachiyomi preference/filter UI are intentionally deferred.

Evidence

• Before: Curd had no Anikoto provider and could not resolve its VRF-protected catalog or MegaPlay streams.
  After: The live test completes search → episodes → sub/dub server selection → encrypted source resolution → signed master → variant → media segment → subtitle.

• Full suite:
  go test ./... -count=1

• Race check:
  CGO_ENABLED=1 go test -race ./internal/providers/anikoto -count=1

• Static analysis:
  go vet ./...

• Live playback flow:
  CURD_LIVE_ANIKOTO=1 go test ./internal/providers/anikoto -run TestLiveAnikotoProviderFlow -v -count=1

Merge Danger

Door: Two-way

The provider can be removed or disabled without data migration or configuration changes. Meta.NoPrefetch is additive and defaults to false for existing providers.

Blast Radius: Provider-local, plus generic prefetch metadata

The primary risk is future Anikoto or MegaPlay protocol changes, particularly server markup, VRF keys, or stream signing.