Fix pre-existing player issues: edit upload paths, playlist sync, DPI, console

src/edit_popup.py: pass and reproduce the server-side edited-media layout
('edited_media/<media_id>/') when saving an edit, falling back to the flat
folder when no media id is available, so uploads land where the server expects.

src/get_playlists_v2.py: preserve every server field (audio, muted, description,
id, position, ...) when rewriting playlist items, instead of rebuilding fixed
dicts that silently dropped them. Web-link items keep their original http(s) url
and are never downloaded.

windows/pyi_runtime_hook.py: declare per-monitor DPI awareness before SDL/Kivy
initialise, so on a scaled display the window is not virtualised to a smaller
resolution (which left a black strip and mis-scaled media).

windows/build_win.bat: optional code signing step for PCs with Smart App Control
enabled, driven by KIWY_SIGN_PFX / KIWY_SIGN_PFX_PASSWORD or a local
kiwy_signing.pfx.

windows/build.spec, windows/README_WINDOWS_BUILD.md, windows/development-track.md:
build notes and manifest updates.

windows/README_WINDOWS_BUILD.md

@@ -10,7 +10,7 @@ The original app was built for **Raspberry Pi (Linux)**, using these technologie
 |-----------|---------------------|-------------------|
 | **GUI** | Kivy 2.3+ | Kivy 2.3+ (works cross-platform) |
 | **Video** | ffpyplayer | ffpyplayer (needs FFmpeg DLLs) |
-| **Card Reader** | evdev (Linux input) | **Not available** — gracefully disabled |
+| **Card Reader** | evdev (Linux input) | ✅ Raw Input API + LL-hook fallback |
 | **Screen Keep-Awake** | xset, xdotool, Wayland | `SetThreadExecutionState` (Win32 API) |
 | **Weblink** | chromium-browser (kiosk) | Chrome/Edge (--kiosk mode) |
 | **Audio** | ALSA/PulseAudio | DirectSound |
@@ -27,9 +27,9 @@ The original app was built for **Raspberry Pi (Linux)**, using these technologie
 - ✅ Web links (opens in Chrome/Edge kiosk)
 - ✅ Network monitoring
 - ✅ Auto-update playlist
+- ✅ Card reader authentication (Raw Input API — see below)
 
 ### What is disabled on Windows
-- ❌ Card reader (evdev is Linux-only; `EVDEV_AVAILABLE = False`)
 - ❌ HDMI power management (tvservice is RPi-specific)
 - ❌ WiFi restart (uses Linux `nmcli`)
 
@@ -112,6 +112,50 @@ For a **single-file .exe**, edit `build.spec` — uncomment the `exe_onefile` se
 }
 ```
 
+## 💳 Card Reader (Windows Edition)
+
+The card reader now works on Windows via the **Raw Input API** (with a
+low-level keyboard-hook fallback). It replaces the Linux-only `evdev`
+implementation automatically when `run_win.py` starts.
+
+- Detection mirrors the Linux logic:
+  1. A device named with `card` / `reader` / `rfid`
+  2. A USB HID keyboard (non-PS/2) — most card readers enumerate this way
+  3. Any remaining keyboard (excluding touchscreens/mice)
+- Only keystrokes from the **selected device** are captured, so the
+  operator's real keyboard cannot pollute card data.
+- Card data ends on **Enter** (same as Linux).
+
+### Card reader config (optional)
+
+Add any of these to `config\app_config.json` next to the .exe:
+
+```json
+{
+  "card_reader_mode": "auto",      // "auto" | "raw" | "hook"
+  "card_reader_device": "",        // e.g. "VID_08FF" to force a specific device
+  "card_reader_timeout": 5         // seconds
+}
+```
+
+- `card_reader_mode`: `auto` (default, tries Raw Input then falls back),
+  `raw` (force Raw Input), or `hook` (force the low-level keyboard hook).
+- `card_reader_device`: optional substring of the device name to pin the
+  reader (e.g. `VID_08FF`, `HID#VID_08FF`). Run the manual test below to see
+  the exact device names on your host.
+- `card_reader_timeout`: how long the swipe popup waits (default 5 s).
+
+### Manual card reader test (no GUI)
+
+```batch
+cd windows
+venv\Scripts\activate
+python win_card_reader.py
+```
+
+Swipe a card within 10 seconds — the tool prints the captured data, then
+exits. The detected devices are listed in the console/log.
+
 ## 🧪 Testing
 
 ```batch