feat(qsv): optional client image with Quick Sync / VAAPI-capable FFmpeg

Goal

Ship an optional StreamDL client image variant whose FFmpeg can use Intel Quick Sync and/or VAAPI when /dev/dri is passed through.

Context

Parent epic: #452
Depends on: #605 (Phase 1 — /dev/dri passthrough docs/compose)

Today Dockerfile.client copies binaries from mwader/static-ffmpeg, which cannot use QSV/VAAPI. Device passthrough alone is insufficient.

Scope

• Add an optional image tag (recommended: client_*-qsv or similar) based on a distro image with Intel media stack + FFmpeg (qsv and/or vaapi in ffmpeg -hwaccels)
• Keep the current static-FFmpeg client as the default
• Document how to pull/run the QSV variant with /dev/dri
• Document using existing FFMPEG_EXTRA_INPUT_OPTS / FFMPEG_EXTRA_OUTPUT_OPTS and/or post_script for a working encode path
• Manual verification checklist on Intel hardware (CI runners typically lack iGPU)

Out of scope

• Replacing the default static client for everyone
• First-class StreamDL hwaccel presets (follow-up after this issue)
• NVIDIA NVENC / AMD AMF

Depends on

• #605

Acceptance

• Optional published client image where ffmpeg -hide_banner -hwaccels lists qsv and/or vaapi
• Default client image unchanged
• Docs for running with /dev/dri + at least one working encode example (in-process EXTRA opts or post_script)
• Clear failure notes when device/drivers are missing

Start with Dockerfile.client and review dependency #605 for the existing /dev/dri passthrough approach. Define the optional client image so ffmpeg -hide_banner -hwaccels lists qsv and/or vaapi while the default image stays unchanged. Manually verify on Intel hardware with /dev/dri, document one working EXTRA opts or post_script encode path, and record missing-device or driver failures.