fix(ci): add placeholder for missing demo-track.smsg

The build was failing because `pkg/player/assets.go` embeds `frontend/demo-track.smsg`,
which was ignored by git and missing in the repository checkout.

This commit:
- Adds a placeholder `pkg/player/frontend/demo-track.smsg` file.
- Updates `.gitignore` to explicitly track this specific file while keeping the global ignore rule.

This ensures `go:embed` can find the file during build/test in CI environments.

.gitignore

@@ -7,6 +7,7 @@ coverage.txt
 
 # Demo content (hosted on CDN)
 demo-track.smsg
+!pkg/player/frontend/demo-track.smsg
 
 # Dev artifacts
 .playwright-mcp/

php/borg-stmf/src/STMF.php

@@ -271,13 +271,8 @@ class STMF
         }
 
         $keyStream = $this->deriveKeyStream($entropy, strlen($data));
-        $result = '';
 
-        for ($i = 0; $i < strlen($data); $i++) {
-            $result .= chr(ord($data[$i]) ^ ord($keyStream[$i]));
-        }
-
-        return $result;
+        return $data ^ $keyStream;
     }
 
     /**

pkg/player/frontend/demo-track.smsg

@@ -0,0 +1 @@
+placeholder for build