fix(e1): address /code-review high findings on the E1 stack

Review round on the whole E1 stack (main..HEAD). 6 findings, all low/medium,
none blocking; fixed for a clean gate-green handoff.

- plex/sync (correctness): the un-enriched cast guard compared the stored cast
  against THIS listing's length, so a trimmed Plex cast on a not-yet-enriched
  row was never applied. Compare against the listing CAP (_LISTING_CAST_CAP=20)
  instead: >cap = enriched (keep, survives a watermark reset), <=cap =
  listing-sourced (track edits in both directions). +2 regression tests.
- main (security): add X-Frame-Options: DENY as the legacy-browser fallback for
  the CSP frame-ancestors clickjacking guard.
- downloads/service (altitude): finalize_if_running now uses a SQLAlchemy 2.0
  update() construct instead of a hand-built text() UPDATE string — same atomic
  WHERE status='running', idiomatic, no identifier interpolation, no manual
  StrEnum coercion. Drops the now-unused text import.
- auth/admin (reuse): extract the SEC-10 "drop untrusted preset password + bump
  epoch" invariant into one helper (revoke_preset_password_if_unverified) so the
  Google-callback and admin-activation paths can't drift.
- tests/migrations (robustness): guarantee the shared schema is restored to head
  in a finally, so a downgrade/re-upgrade failure can't cascade into later tests.
- worker (simplification): align _finish_from_cache's display_name fill with the
  _download path's guard (no behavior change).

Gate green: ruff clean, 334 pytest (0 skip), frontend unchanged.

backend/tests/test_migrations.py

@@ -59,5 +59,10 @@ def test_head_migration_downgrades_and_reupgrades(db):
     # it lands, not during a rollback. Leaves the schema back at head for the rest of the session.
     cfg = Config("alembic.ini")
     command.downgrade(cfg, "-1")
-    command.upgrade(cfg, "head")
-    assert _structural_drift() == []
+    try:
+        command.upgrade(cfg, "head")
+        assert _structural_drift() == []
+    finally:
+        # Always leave the SHARED schema at head, whatever the upgrade/assert above did — otherwise a
+        # failure here strands the DB one revision behind and cascades into every later DB-lane test.
+        command.upgrade(cfg, "head")