Handle suffix byte ranges for media streams

[aiirvizionz]

Summary

• add a shared HTTP byte-range parser for media streaming
• correctly handle suffix ranges such as Range: bytes=-10 as the last 10 bytes
• reject malformed or unsatisfiable ranges consistently with 416 responses
• use the shared parser in both media streaming endpoints

Validation

• tsc --noEmit
• node --test tests/http-range.test.mjs tests/url-guard.test.mjs
• git diff --check