The stream worker discarded ffmpeg stderr, so reconnect loops were opaque.
Capture stderr and log it with the RTSP URL/credentials redacted, so the
real cause (auth, timeout, option, URL parse) is diagnosable without
leaking the source address.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>