Replay fuori da Puma, fix ops cron e firma release Android.

Dopo auth Rails redirect a URL presigned su /media/ (edge → Garage); aumenta
RAILS_MAX_THREADS, corregge ingest log ops via stdin e keystore Play Console.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/controllers/public/replay_controller.rb

@@ -52,6 +52,15 @@ module Public
     private
 
     def serve_video(disposition:)
+      expires_in = disposition == "attachment" ? MatchLiveTv.replay_download_url_ttl_seconds : MatchLiveTv.replay_presigned_url_ttl_seconds
+      redirect_url = Recordings::PublicMediaUrl.new(
+        key: @recording.storage_key,
+        expires_in: expires_in,
+        disposition: disposition,
+        filename: disposition == "attachment" ? download_filename : nil
+      ).call
+      return redirect_to redirect_url, allow_other_host: true if redirect_url.present?
+
       Recordings::ServeFromStorage.new(
         key: @recording.storage_key,
         content_type: "video/mp4",
@@ -66,6 +75,9 @@ module Public
       key = @recording.thumbnail_storage_key
       return head :not_found if key.blank?
 
+      redirect_url = Recordings::PublicMediaUrl.new(key: key, expires_in: MatchLiveTv.replay_presigned_url_ttl_seconds).call
+      return redirect_to redirect_url, allow_other_host: true if redirect_url.present?
+
       Recordings::ServeFromStorage.new(
         key: key,
         content_type: "image/jpeg",