## Summary
- `mintViewerJwt` read `process.env.UI_ADMIN_MODULE_TOKEN`, which was never set anywhere -- every code-token mint request sent `Apikey m:undefined`, auth rejected it with `AUTH_002`, and the failure was only ever logged server-side. This is why the stream player, composition source thumbnails, and the compositor preview all stayed on "Cargando..." forever with no visible error. Fixed to use `SERVICE_TOKEN`, which already carries the correct value (same as auth's `UI_ADMIN_SERVICE_TOKEN`).
- Sidebar's "Overlays" link now points at frontend-overlays' home page (was `/library`) and opens in a new tab (was in-place navigation away from admin).