fix(logs): deep-review round 2 — a stack names code, not data, and survives a failed write

- A failure keeps its traceback unless it is yt-dlp's or our own StatedFailure (a
  message that is the whole story). A plain RuntimeError, RecursionError or OSError
  is also what a bug of ours raises, and its stack is the only lead.
- The stack is scrubbed link by link (logs.scrubbed_stack): a chained DownloadError
  under a DB error no longer prints yt-dlp's text unscrubbed.
- Engine hide_parameters: a DB error's message no longer carries the title or path
  it was writing.
- The download and edit failure lines go out even when their DB write fails.
- The worker's child_exit/crash/supervisor lines say download.job.failed only when
  the job failed there; a crash the DB will not record no longer ends the thread.
  Stopping a paused child is download.child.stopped, not a second abort.
- log_safe also covers generic ids with spaces, playlist titles and bare ids.
- The ffmpeg image steps log the failure kind, not the argv with its path.
- The consent contract accepts only the body of a plain consented_trace() check,
  and any level that may be TRACE.
- Tests for each; every one mutation-checked.

backend/tests/test_worker_supervisor.py

@@ -87,6 +87,7 @@ def test_no_progress_stall_kills_and_fails_the_job(monkeypatch, rec):
     fail = next(c for c in rec if c[0] == "fail")
     assert fail[2]["error_code"] == "network"
     assert "stalled" in fail[2]["error"].lower()
+    assert fail[2]["cause"] == "stalled"  # the line the killed child never gets to write
 
 
 def test_route_pause_kills_but_keeps_the_route_status(monkeypatch, rec):
@@ -120,6 +121,7 @@ def test_wall_clock_cap_kills_even_while_progressing(monkeypatch, rec):
     worker._run_supervised(1, 99)
     fail = next(c for c in rec if c[0] == "fail")
     assert "time limit" in fail[2]["error"].lower()
+    assert fail[2]["cause"] == "timeout"
 
 
 def test_child_crash_without_finishing_is_failed(monkeypatch, rec):
@@ -131,6 +133,8 @@ def test_child_crash_without_finishing_is_failed(monkeypatch, rec):
     assert "reset_asset" in names
     fail = next(c for c in rec if c[0] == "fail")
     assert "unexpectedly" in fail[2]["error"].lower()
+    # Its line is `_fail_running`'s, so it is logged only if the job really failed here.
+    assert (fail[2]["cause"], fail[2]["exit_code"]) == ("child_exit", 1)
 
 
 def test_child_nonzero_exit_that_already_set_state_is_left_alone(monkeypatch, rec):
@@ -258,7 +262,7 @@ def test_a_crashed_jobs_crash_line_and_cleanup_carry_the_job_id(monkeypatch):
     monkeypatch.setattr(worker, "_claim_job", claim)
     monkeypatch.setattr(worker, "_process_job", crash)
     monkeypatch.setattr(
-        worker.log, "exception", lambda *a, **k: seen.setdefault("crash", logs._job_id.get())
+        worker.log, "error", lambda *a, **k: seen.setdefault("crash", logs._job_id.get())
     )
     monkeypatch.setattr(
         worker, "_fail_running", lambda *a, **k: seen.setdefault("cleanup", logs._job_id.get())