feat(qsv): optional client image with Quick Sync / VAAPI-capable FFmpeg

Goal

Ship an optional StreamDL client image variant whose FFmpeg can use Intel Quick Sync and/or VAAPI when /dev/dri is passed through.

Context

Parent epic: #452
Depends on: #610 (Phase 1 — /dev/dri passthrough docs/compose)

Today Dockerfile.client copies binaries from mwader/static-ffmpeg, which cannot use QSV/VAAPI. Device passthrough alone is insufficient.

Note: Prefer this issue over earlier duplicate drafts (#606, #608) if those remain open — this token cannot close them.

Scope

• Add an optional image tag (recommended: client_*-qsv or similar) based on a distro image with Intel media stack + FFmpeg (qsv and/or vaapi in ffmpeg -hwaccels)
• Keep the current static-FFmpeg client as the default
• Document how to pull/run the QSV variant with /dev/dri
• Document using existing FFMPEG_EXTRA_INPUT_OPTS / FFMPEG_EXTRA_OUTPUT_OPTS and/or post_script for a working encode path
• Manual verification checklist on Intel hardware (CI runners typically lack iGPU)

Out of scope

• Replacing the default static client for everyone
• First-class StreamDL hwaccel presets (follow-up)
• NVIDIA NVENC / AMD AMF

Depends on

• #610

Acceptance

• Optional published client image where ffmpeg -hide_banner -hwaccels lists qsv and/or vaapi
• Default client image unchanged
• Docs for running with /dev/dri + at least one working encode example (in-process EXTRA opts or post_script)
• Clear failure notes when device/drivers are missing

Start with Dockerfile.client and the prerequisite /dev/dri passthrough work in #610. Check the image's FFmpeg entry point with ffmpeg -hide_banner -hwaccels, then document running the optional image with /dev/dri and an encode example using the existing FFMPEG_EXTRA_INPUT_OPTS, FFMPEG_EXTRA_OUTPUT_OPTS, or post_script. Done means the optional image exposes qsv or vaapi, the default image is unchanged, and missing-device or driver failures are documented.