On-demand: encrypted chunks fetched from this server, decrypted in your browser (AES-256-GCM), streamed via MSE with a sliding buffer.