feat: add playlist admin panel UI, now-playing pill, CSS, and marketplace script

- Admin panel in rail with collapsible playlist section (create, rename,
  delete, expand, drag-reorder tracks, playback controls, active selection)
- playlist.js IIFE wired to REST API with CSRF meta-tag injection
- Live events forwarded from console.js via window CustomEvent
- Admin-only now-playing pill overlaid on canvas surface
- playlist-now-playing marketplace script draws rounded pill on canvas
- Fix: add data-asset-type/id/name to asset list items so playlist.js can
  populate the track-add dropdown
- Fix: renderer.js _onPlaylistTrackEnded reads XSRF-TOKEN cookie for CSRF
- Fix: playlist.js commandPause no longer passes headers:{} that stripped CSRF
- Fix: PLAYLIST_PREV restarts current track when currentTime >= 3 s

src/main/resources/static/js/admin/console.js

@@ -727,6 +727,11 @@ export function createAdminConsole({
             applyCanvasSettings(event.payload);
             return;
         }
+        // Forward playlist events to playlist.js via a DOM event
+        if (event.type && event.type.startsWith("PLAYLIST_")) {
+            window.dispatchEvent(new CustomEvent("playlistEvent", { detail: event }));
+            return;
+        }
         const assetId = event.assetId || event?.patch?.id || event?.payload?.id;
         if (event.type === "PREVIEW" && event.patch) {
             applyPreviewPatch(assetId, event.patch);
@@ -1551,6 +1556,9 @@ export function createAdminConsole({
             li.classList.add("selected");
         }
         li.classList.toggle("is-hidden", !!asset.hidden);
+        li.dataset.assetId = asset.id;
+        li.dataset.assetName = asset.name || "";
+        li.dataset.assetType = asset.assetType || "";
 
         const row = document.createElement("div");
         row.className = "asset-row";