Connect live streaming to VOD. Two halves: - While live: re-enable the S3 upload path in stream_session (it was commented out due to a send-on-closed-channel panic at teardown). Fix the lifecycle — idempotent Close (sync.Once), drain the session's goroutines before closing the uploader — and upload bare canonical MUXL .m4s segments (no per-object init) under a live-rec/ prefix so the objects of one stream concatenate directly. Index each object's livestream URI in the statedb S3Segment table. - Finalize: new authenticated place.stream.media.finalizeLivestream XRPC procedure concatenates a stream's recorded objects under one synthesized init header into a content-addressed blob (server-side S3 UploadPartCopy via ConcatWithHeader, no bulk re-upload), regenerates the playback sidecars with `muxl unwrap` (reusing regenerateSidecars), and publishes the media.origin + media.track records — reusing the existing getUploadStatus / publishVideo client contract. No gstreamer remux and no re-signing: the original live C2PA signatures are preserved. Runs as a background task on the dedicated VOD worker pool. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>