Fix Cast teardown leaks, keyframe latch, and DLNA session lifecycle

Dropped frames never requested a keyframe, SessionEnded skipped ordered
stop (portal/TV/FFI leak, next start could abort), and a late end could
kill the following cast. Failed starts left PlatformClientPosix alive.
DLNA leaked its HTTP server and ignored portal EOS.

Also: start no longer blocks the daemon actor, IPC accept/request loops
stay up, HLS Range is clamped, LAN IP follows the renderer subnet, and
the picker closes before the portal dialog and handles Escape.

vendor/rust_cast-0.21.0/PATCHES.md

@@ -22,11 +22,14 @@ channel claims the namespace.
 
 ## The patch
 
-`src/lib.rs`: added `CastDevice::send_message<M: Serialize>(&self, namespace,
-destination, message)`, built the same way `ReceiverChannel::broadcast_message()`
-is internally, but with a caller-supplied `destination` instead of a
-hardcoded `"*"`. See the doc comment on that method for the exact rationale
-(marked "LOCAL PATCH (breadcast, not upstream)").
+`src/lib.rs`: added `CastDevice::send_message(&self, namespace: &str,
+destination: &str, message: &str)`, built the same way
+`ReceiverChannel::broadcast_message()` is internally, but with a
+caller-supplied `destination` instead of a hardcoded `"*"`. The payload is
+a raw string (already-serialized JSON from the vendored openscreen C++),
+not a `Serialize` value -- a generic `M: Serialize` would double-encode
+the OFFER. See the doc comment on that method (marked "LOCAL PATCH
+(breadcast, not upstream)").
 
 ## Rolling the pin