Local test sink destination: rehearse the whole pipeline with zero risk

[Soulhackzlol]

Stacked on #33 - merge that first; GitHub retargets this one to main automatically.

What

The in-binary RTMP sink (instantclone sink) becomes a destination type. Pick Local test sink in the Destinations tab and InstantClone spawns its own tiny receiver on this PC and streams to it. No platform account, no stream key, nothing leaves the machine - test arm/activate/cut (and vertical) end to end before touching a real key.

How

• Managed child process. The egress supervisor owns one instantclone sink child for all sink destinations: spawned when one is enabled (before the pump dials, so the receiver is listening first), killed when the last is disabled or removed, reaped and respawned (10 s throttle) if it dies, kill_on_drop so app exit takes it down, CREATE_NO_WINDOW so nothing flashes.
• Fixed high ports (rtmp :19350, player :19351) so manual sink runs on the documented :1936/:1937 defaults and the e2e script never collide with the managed instance.
• Feedback where you can see it. The sink's [sink] log lines (publish accepted, the 1 Hz stat windows) are forwarded into the dashboard's Logs tab, and the destination card gets a ▶ Watch output link to the sink's built-in live player - watch exactly what a platform would receive, delay and cuts included.
• Form UX. The stream-key field hides for sink (any key works), and an open-by-default disclosure explains the feature inline. The first-run wizard deliberately does not offer it: the wizard writes the legacy single-destination config and its job is wiring your real platform.

Verification

• cargo fmt --check, clippy --all-targets -- -D warnings, cargo test --release: 235 passed (new config test: sink destination is self-contained - fixed URL, well-formed and valid with no key).
• Verified live end to end: app started with an enabled sink destination -> child spawned and both ports answered; a real ffmpeg publish flowed proxy -> sink with "publish accepted" landing in the dashboard log; the card reported alive + bitrate; the built-in player served on :19351; disabling the destination killed the child and freed the ports, with the stop logged.