Close three holes in the card release path

A second review pass over the pool. All three are the same shape: state
or a listener outliving the video it belonged to.

attachProxyFallback replaces whatever fallback an image currently has,
so a call arriving late -- a race hitting its patience timeout after the
card was recycled -- took away the live listener and left a dead one, and
the new video's thumbnail would then fail with nothing behind it. This
one was self-inflicted: the detach came in last round to stop the
listeners accumulating, and introduced the clobber. It is token-guarded
now, like every other path that can arrive late.

The favourite pop is cleared by animationend, which never fires on a card
release() has already detached -- detached elements run no animations. So
the class rode into the pool and replayed on the next video the card
showed. Favourite something and flick-scroll to see it.

And withOrigin compared a token that dataset reports as undefined for an
unstamped card, which matched every unstamped card instead of none --
failing open in the guard whose whole purpose is noticing that the grid
has recycled the card out from under the player.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBDkEXP4htyXTCZUwMLphd

frontend/js/player.js

@@ -75,7 +75,11 @@ App.player = App.player || {};
     };
 
     const withOrigin = function(el, token, fn) {
-        if (el && el.dataset.playerToken === token) fn(el);
+        // `token` must be truthy in its own right: dataset yields undefined for
+        // a missing attribute, so without this an unstamped token would match
+        // every card that has no stamp -- including one the grid has recycled,
+        // which is precisely the case this guard exists to catch.
+        if (el && token && el.dataset.playerToken === token) fn(el);
     };
 
     const addCleanup = (fn) => cp.cleanups.push(fn);