[yashiels]

Closes #132

Replace the unavailable vidsrcme.ru origin with vidsrc.sh in shared defaults, Docker build arguments, committed environment defaults/examples and documentation. Preserve custom environment overrides and existing URL/CSP behavior.

Verification:

• New regression failed before migration; all 3 cases pass afterward, including Robots 9928 and custom-origin CSP.
• 366 tests passed across 27 suites.
• Lint passed with 4 existing warnings; format check and production build passed.
• Local built app returned HTTP 200 with the new frame-src.
• Actual CI workflow exercised locally using act on Forge: Code Quality and Build passed. Test setup failed before Jest in actions/cache@v4 with ReferenceError: __dirname is not defined in ES module scope; ci-complete consequently failed. Direct Jest suite passes. Hosted CI must pass before merge.
• Local builds lacked the TMDB key; production workflow supplies it.
• Signed commit verified. No unrelated changes.

Production rollout: merge triggers the existing production deploy workflow, then verify the live iframe and CSP. Full third-party playback is not established by embed HTTP success.

[sentinel-skyner]

🛡️ Sentinel review

No material issues found in the submitted diff.

_{Automated review via cursorbridge:gpt-5.3-codex. Findings only — not an approval. Push new commits to re-review.}