test: Add e2e release gate (script + manual checklist)

Releases need more than eyeballs: scripts/e2e-api-check.sh now runs
18 assertions over the live instance (login/refresh, listings, private
rows, subscriptions incl. remote channels, watching + stored position,
file token, playlist reachability) and TESTS.md defines the manual
D-pad checkout that a script cannot do.

Also switch the channels screen to the user's own channels (the
search-based local listing rejects empty queries) and resolve the real
account name at login since logins accept email addresses.

BACKLOG.md

@@ -23,8 +23,12 @@ Status vocabulary: `todo` · `doing` · `done`.
   `GET videos/{shortUuid}?userHistory=true` (verified working, returns
   `userHistory.currentTime`), next/previous video from list, focus current item in
   history screen.
-- Thumbnails of private/internal videos may 404 — probe server behavior and add a
-  fallback (generic poster) when required.
+- Thumbnails of private/internal videos may 404 — verified on tube.jeena.net:
+  instance thumbnail paths are publicly readable (HTTP 200 without auth); add a
+  fallback poster only if other instances behave differently.
+- Security note for tube.jeena.net: object-storage (R2) media for private test
+  videos is publicly readable without token ("private" only via URL obscurity).
+  Flag to the instance admin; the app must not rely on this laxness.
 - Verify `searchTarget=local` channel search behaves well for instances without
   federation; consider `search/video-channels` endpoint as an alternative.
 - Release build: enable `minifyEnabled` + R8 rules, decide on signing, versioning scheme.