feat: Phase 4b — shader bundle fetch for directory streams

[geldoronie]

Follow-up to #47 and #49 (Phase 4b — shader bundle fetch).

A directory entry references its active shader by name
(crt/crt-mattias.glslp, crt/crt-easymode.glslp, etc.). If the
client browsing the directory doesn't have that preset locally, it can
connect to the stream but can't reproduce the host's look — it'll fall
back to whatever shader the client has currently selected, which is at
best confusing and at worst makes the directory feel broken.

The same gap also affects #47's /meta protocol: a host can announce
"I'm using crt-mattias.glslp" and the client honours that announce
only if it already has that file.

Scope

• Define a small bundle format: a single shader preset + the
  .glsl / .glslp files it references + any LUT textures. Tarball
  or zip, content-addressable by sha256.
• Host serves the bundle for its active shader from a new endpoint
  (GET /shaders/<sha256> or similar). Re-uses the existing HTTP
  surface, so the same password / Bearer / Basic auth from feat: public stream directory — opt-in discovery for remote RetroCapture streams #49
  applies automatically.
• Client, on connect (or when the host changes shader mid-stream
  via /meta), checks whether it has the announced shader by hash.
  If not, downloads the bundle, extracts to a per-stream cache
  directory, loads it into the pipeline.
• Cache lives under <user-data-dir>/shader-cache/ and is keyed
  by sha256 so two streams using the same preset share storage.
• UI surfaces a "downloading shader…" status during the fetch so
  the user understands the brief delay between connect and the
  shader becoming active.

Constraints

• Bundles must be small (target < 1 MB for typical CRT shaders, large
  LUTs may push it to a few MB). Anything bigger should be flagged so
  hosts can opt out of bundle-serving and just show "shader not
  available locally" instead.
• Bundle contents come from the host's existing shader directory
  unchanged — this is a transport, not a shader format change.
• Auth: the bundle endpoint reuses the existing password gate from
  feat: public stream directory — opt-in discovery for remote RetroCapture streams #49 Phase 3 (entire HTTP surface behind the password).

Out of scope

• Shader marketplace / discovery beyond what the directory already
  provides (the directory listing tells you what shader a stream is
  using; this issue just makes that information actionable).
• Editing or recompiling shaders client-side.
• Caching across sessions of user-modified shaders. Cache key is
  sha256, so any local edit invalidates the entry and re-fetches.

Acceptance

• Client connects to a directory stream using a shader the client
  has never seen before; the host's exact look reproduces within a
  second of connect.
• Host changes shader mid-stream via /meta; client fetches the new
  bundle and the visual switch lands within a frame or two.
• Two streams using the same shader share one cache entry.

Called out as coupled with #49 in that issue's body — the directory is
meaningfully degraded without this.