v1.5.4-stable

## What's Changed

 **Security**:
 - [High] Stored XSS via HTML preview: `<script>` is no longer preserved in srcdoc, the preview iframe is opaque-origin (no `allow-same-origin`), the session cookie is HttpOnly, and the SPA shell sends a `script-src` CSP inherited by srcdoc frames (GHSA-vvm6-jwrf-hgmg) -- thanks @qrn12580

 **New Features**:
 - Added option to globally disable the "Install App" message via `frontend.disablePWAInstall`

 **Notes**:
 - [docker] upgraded ffmpeg version 8.1.2 to 9.0.1

 **BugFixes**:
 - "install app" message reappears after being cleared on device.
 - External subtitles fail to load on public video shares due to authenticated subtitle endpoint (#2822) (#2827)
 - Restored upload chunk size `0` to disable chunking as documented ([#2202](https://github.com/gtsteffaniak/filebrowser/issues/2202)); workaround for iOS 26 multi-chunk upload stalls ([#2734](https://github.com/gtsteffaniak/filebrowser/issues/2734)).

## All Changes
* fixed install app bug by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/2849
* fix GHSA-vvm6-jwrf-hgmg by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/2852
* updated ffmpeg and dependencies by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/2855
* fix: restore upload chunk size 0 to disable chunking (#2734) by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/2863
* fix: serve subtitle content on public video shares by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/2864

**Full Changelog**: https://github.com/gtsteffaniak/filebrowser/compare/v1.5.3-stable...v1.5.4-stable