Add live meeting output previews to the cloud dashboard

Provide browser playback of ongoing meeting outputs in cloud-dashboard MeetingView using server-side SRT-to-HLS conversion. User explicitly prefers this simpler architecture over local-streamer output taps. Do not add gstreamer-app or change room pipelines for this feature. Verified existing implementation: Cascade already supports source.protocol=srt, pulls the configured relay with each stream key using m=request, and serves HLS on demand at /live/{stream_key}/index.m3u8. Stream supervisors retry source interruptions and stop after inactivity. Meeting outputs already expose stream_uuid and bound_output_id, so use the same UUID to request the corresponding HLS stream. Existing checked-in Cascade config selects RTMP and example SRT host; actual SRT-enabled deployment and HTTPS HLS base URL are not established. Scope: reuse Cascade, configure or reuse a SRT-enabled instance for the meeting relay, and embed per-output HLS players in the meeting show view with muted autoplay/audio controls and honest loading/error states. Preserve SRT copy links. Only render bound outputs for the appropriate live meeting. Clean up players when switching/stopping/unmounting. Prefer remuxing compatible H264/AAC output over unnecessary transcoding. User approved hls.js; it is installed for authenticated browser playback with current bearer headers on each playlist/segment request. Determine access protection appropriate to meeting previews rather than implicitly publishing private feeds. Acceptance: browser displays actual composed meeting output with audio available; local-streamer and NDI framing preview unchanged; reuse existing on-demand conversion/recovery; correct output identity and lifecycle; dashboard tests/build pass and any live deployment/media validation limitations explicit. Implemented local setup through ./dev: MediaMTX SRT on LAN/loopback UDP8890, pinned current Cascade image pulling preview:8890, loopback HTTP8080, two-second HLS segments and ABR disabled for H264/AAC remux. Initial cached image was stale; pulled and verified current digest40d32dc0d42791b0406dd1ad946350ecc65252e4a6cd354c9eef2a632d01c819. ./dev router sets CASCADE_URL locally; ./dev dashboard defaults new meetings to LAN SRT ingest. Production passes CASCADE_URL to cloud-router at runtime. No room-pipeline changes or production/remote appliance actions. Cloud-router exposes per-output HLS proxy routes guarded by meeting-read permission, municipality scope, active status and bound pool ownership. Rewrites manifest references into that authorized route, refuses cross-stream/origin URLs, does not forward API credentials, streams media responses and disables caching. Hls.js playback is lazy-loaded and muted initially. Follow-up layout places a full-column preview above Overlay and reuses existing output tabs; only the selected output plays, selection survives meeting refreshes, and switching tabs disposes the old player. Verified final validation: 137 cloud-router tests pass (2 external-NATS tests ignored); 38 Cascade tests pass (1 external real-FFmpeg test ignored); 9 dev workflow tests and 37 dashboard tests pass; dashboard build, Rust formatting and diff checks pass. Cloud-router clippy completes with six warnings confined to unchanged auth/boxes/pause-image code. Separate real local SRT feeds and isolated router DB successfully return proxy HLS playlists. Before the tabbed-layout refinement, Chrome verified two bound output players, visual playback/time advancing, default mute/controls, independent pause/resume/unmute, navigation return playback, mobile320/390 layouts and unauthenticated preview401. The final tabbed/full-width-layout browser test was cancelled; user visually accepted the new layout. Final dashboard tests/build still pass; do not claim automated tab-switch acceptance ran. Browser tools could not inspect successful request headers, decoded dimensions/audio-track metadata or prove per-request cessation. Separate authenticated ffprobe requests through the proxy verified both received streams as H264640x360 plus AAC48kHz mono. Unit HTTP tests verify no bearer forwarding, rewritten session/segment paths, ranges and permission/tenant/binding/lifecycle rejection. After browser/probe consumers stopped, Cascade /status verified no active or pending pulls while synthetic publishers were still running. Audible output and real hardware overlays/pause-image changes were not exercised. Existing .dev/router.db contains an active meeting pointing at production SRT ingest. Left it untouched and did not start/restart the normal router (port9000 was already stopped). Validation uses separate .dev/preview-validation/router.db on9001, Vite5174 and synthetic feeds only. Validation processes (isolated router9001, Vite5174 and two synthetic publishers) are stopped and test ports verified closed; removed the temporary token file. Local Compose infrastructure remains running/healthy. Static feature review completed with explicit coverage limitations; its sole medium candidate concerns ABR bootstrap behavior. User clarified ABR is never used in production and likely to be removed, so no ABR expansion was implemented; documented source.protocol=srt and abr.enabled=false as the supported configuration. No production deployment or normal dev DB mutation performed. Handoff: restart ./dev router and ./dev dashboard to load new environment settings, and use a new local-ingest meeting rather than the retained production-target meeting. Published commit c0d04dc on feature/add-meeting-output-previews against main. PR #149: https://git.kaukus.no/Kaukus/streaming-engines/pulls/149 . Final checks repeated successfully: cargo fmt --all --check; cargo check --locked -p cloud-router -p cascade; cargo test --locked -p cloud-router -p cascade (137/38 pass, 2/1 external tests ignored); cloud-router all-target clippy completes with pre-existing warnings; 37 dashboard and 9 dev tests pass; dashboard production build and diff checks pass. Temporary tab-validation router9001, Vite5174 and synthetic publishers were stopped and ports verified closed; normal user dev services and local Compose infrastructure left running. Remote CI result not established.