- Removed expected_password from _reset_state
- Removed password field from args_directory/args_zip fixtures
- Removed set_auth_password calls from initialized_dir/initialized_zip
- Removed _dummy_auth_header function
- Removed Authorization headers from client_dir/client_zip fixtures
- Merged hash_page and hash_page_with_refresh into single /{file_hash} endpoint
- Added optional order and delay query parameters
- Updated _render_page to use _build_url for query param URLs
- Updated play/pause buttons to use query param format
- Removed old /{order}/{delay}/{file_hash} route
