extractors: keep freshporno/porn00/pornxp/fpoxxx on WebView (IP-bound CDN)

Re-checked whether these four KVS tubes could move to server-side resolve
like yespornvip/pornditt/porntrex. All four are reachable from the backend,
but cross-IP testing showed their final CDN URLs are IP-bound to the
resolving host (403 / connection refused from a different IP; fpo.xxx even
embeds the resolver IP in its acctoken). Unlike the portable cdn5/twa CDNs,
backend resolve cannot produce a mobile-playable URL here without a proxy,
which is out of scope for the public app.

- porn00: was using force_proxy resolve (violated the no-proxy stance);
  switched to the WebView fallback like its siblings. The ad exposure that
  originally motivated the proxy path is mitigated by the recent ad-filter
  work (AD_HOSTS + cover overlay + injected-JS ad-CDN skipping).
- freshporno/pornxp/fpoxxx already on WebView fallback; comments updated
  with the cross-IP findings so this isn't re-investigated.
- Dropped the now-unused tube extractor imports (F401).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/extractors/__init__.py

@@ -28,15 +28,12 @@ from app.extractors.tubes import (
     _vps_blocked_fallback,
     _ytdlp,
     eporner,
-    freshporno,
     hqporner,
     latestpornvideo,
     paradisehill,
-    porn00,
     pornditt,
     pornhat,
     porntrex,
-    pornxp,
     sxyprn,
     yespornvip,
 )
@@ -87,6 +84,9 @@ _REGISTRY: dict[str, Callable[[str], list[StreamSource] | None]] = {
     # server-side (decode + follow 302 → portable twa.tgprn.com CDN). Wcześniej WebView
     # fallback łapał VAST preroll (trafostatic) zamiast contentu. Patrz pornditt.py/_kvs.py.
     "porndittcom": pornditt.extract,
+    # fpoxxx — KVS, plain get_file + license. 2026-06-01 (task #20): get_file 302 →
+    # `videos3.fpo.xxx/remote_control.php?acctoken=<base64>` — zdekodowany acctoken
+    # zawiera WBITY IP serwera-resolvera → definitywnie IP-bound. WebView only.
     "fpoxxx": _vps_blocked_fallback.extract,
     "sxylandcom": _vps_blocked_fallback.extract,
     # Aggregator tubes — generic embed-iframe → hoster unpacker
@@ -110,15 +110,21 @@ _REGISTRY: dict[str, Callable[[str], list[StreamSource] | None]] = {
     # (2026-05-28: krótko-żywy switch na freshporno.extract z force_proxy=True
     # cofnięty po feedbacku Jana "video proxy mnie nie interesuje, idziemy
     # publicznie".)
+    # 2026-06-01 (task #20): _kvs.resolve_kvs dekoduje function/0 OK, ale finalny
+    # cdn2.freshporno.org/remote_control.php?cv=... jest nieosiągalny z residential
+    # IP (connect 000) → backend-resolve bezużyteczny. WebView pozostaje.
     "freshpornoorg": _vps_blocked_fallback.extract,
-    # porn00 — KVS engine z v-acctoken w URL. Backend extract działa (zweryfikowane
-    # 2026-05-23), zwraca świeże get_file URL-e z `force_proxy=True` flag.
-    # `_proxify_link` rozwija je przez VPS proxy (CDN token IP-bound do VPS, mobile
-    # direct = 403). Bug-reports `5037b3e3`/`e8e3198b` 2026-05-22: WebView fallback
-    # pokazywał reklamę full-screen (porn00.org ma agresywny ad-network) — mobile
-    # nigdy nie dochodził do `<video>` tag dla INJECTED_JS scrape. Z fresh extract
-    # mobile dostaje proxy URL od razu, ExoPlayer gra bez WebView.
-    "porn00org": porn00.extract,
+    # porn00 — KVS engine. 2026-06-01 cross-IP re-test (task #20): get_file 302 →
+    # `fe.porn00.org/videos/.../<id>.mp4?token=&expires=` zwraca 403 z residential
+    # IP → token IP-bound do resolvera (VPS), NIE portable jak yespornvip/pornditt.
+    # Backend-resolve nie daje mobile-playable URL bez proxy, a video-proxy odpada
+    # (public app, feedback Jana). Per polityka "IP-bound CDN → WebView": switch z
+    # porn00.extract (force_proxy=True, łamało no-proxy) na _vps_blocked_fallback.
+    # Ad-risk z bug-reportów 5037b3e3/e8e3198b złagodzony przez ad-filter (31d9076:
+    # AD_HOSTS + coverOverlay + INJECTED_JS skip ad-CDN).
+    "porn00org": _vps_blocked_fallback.extract,
+    # pornxp — `<source> //sr.porn-xp.com/<token>/.../720.mp4` (redirect → xpxp.eu).
+    # 2026-06-01 (task #20): 403 cross-IP → token w path IP-bound. WebView only.
     "pornxpph": _vps_blocked_fallback.extract,
     # yesporn.vip — KVS engine. VPS znów dociera (HTTP 200, odblokowane jak porntrex),
     # więc resolvujemy SERVER-SIDE: dekoduj flashvars `video_url`/alt/alt2 (function/0/ +