feat: add secure platform publish gate

[anvsk]

Summary

• add reference-only publishQueryRef for signed RTMP publish queries while keeping credentials out of endpoint URLs and logs
• add aimedia publish-check plus stable PublishRejected / Command classification
• add a redacted tools/platform.ps1 gate for YouTube, Twitch, Tencent Cloud, Alibaba Cloud, and custom endpoints
• record V3-03F3a/F3b as complete while keeping real two-platform media acceptance (F3c) incomplete

Verification

• cargo test --locked -p aimedia-rtmp publish_query_reference_is_transmitted_without_entering_the_endpoint
• cargo test --locked -p aimedia-rtmp publisher_classifies_a_rejected_publish_command_without_peer_details
• cargo check --locked -p aimedia-core -p aimedia-rtmp
• Linux Docker: cargo check --offline --locked -p aimedia
• PowerShell parser check for tools/platform.ps1
• MediaMTX 1.20.0 accepted the local publish check and produced a redacted pass report

External endpoint status

This PR does not claim platform compatibility. In the current network, YouTube and Twitch ingest names resolve to the local proxy range 198.18.0.0/15 and both aimedia and FFmpeg fail during RTMP handshake. Those attempts are documented as failed diagnostics, not as V3-03F3 completion. No real stream key was stored or printed.

apps/ remains untracked and is not part of this PR.