feat(qsv): optional client image with Quick Sync / VAAPI-capable FFmpeg

Goal

Ship an optional StreamDL client image variant whose FFmpeg can use Intel Quick Sync and/or VAAPI when /dev/dri is passed through.

Context

Parent epic: #452
Depends on Phase 1 device passthrough/docs.

Today Dockerfile.client copies binaries from mwader/static-ffmpeg, which cannot use QSV/VAAPI. Device passthrough alone is insufficient.

Scope

• Add an optional image tag (recommended: client_*-qsv or similar) based on a distro image with Intel media stack + FFmpeg (qsv and/or vaapi in ffmpeg -hwaccels)
• Keep the current static-FFmpeg client as the default
• Document how to pull/run the QSV variant with /dev/dri
• Document using existing FFMPEG_EXTRA_INPUT_OPTS / FFMPEG_EXTRA_OUTPUT_OPTS and/or post_script for a working encode path
• Manual verification checklist on Intel hardware (CI runners typically lack iGPU)

Out of scope

• Replacing the default static client for everyone
• First-class StreamDL hwaccel presets (Phase 3)
• NVIDIA NVENC / AMD AMF

Depends on

• Phase 1: device passthrough docs/compose

Blocks

• Phase 3 first-class hwaccel knobs (needs a capable binary to target)

Acceptance

• Optional published client image where ffmpeg -hide_banner -hwaccels lists qsv and/or vaapi
• Default client image unchanged
• Docs for running with /dev/dri + at least one working encode example (in-process EXTRA opts or post_script)
• Clear failure notes when device/drivers are missing

Start with Dockerfile.client and the existing Phase 1 device passthrough/docs. Define the optional image variant and verify on Intel hardware that ffmpeg -hide_banner -hwaccels lists qsv and/or vaapi with /dev/dri; document one working encode using FFMPEG_EXTRA_INPUT_OPTS, FFMPEG_EXTRA_OUTPUT_OPTS, or post_script, plus missing-device and driver failures, while leaving the default image unchanged.