fix(r5): address the /code-review high round — 10 findings

- HLS sweep only deletes directories matching the session-name shape; the root
  is admin-configurable and may be a shared path
- playlist unwrap picks the first entry that actually downloaded, not entries[0]
- concat quoting keeps backslashes literal (ffmpeg treats them so inside '')
- ArrowUp/Down defer while the focused element can still scroll that way
- the staging fallback skips yt-dlp working files (.part-Frag/.ytdl/.temp/.fNNN)
- the boot HLS sweep runs off the event loop
- volume persistence is debounced (was a setItem per wheel notch) and a spin no
  longer loses notches to the iframe's lagging getVolume
- _Breaker.run owns the whole open/call/record protocol; four call sites shrink
- should_prune extracted and unit-tested, plus RSS error-vs-empty tests
- the worker exits non-zero when the schema never lands

backend/app/downloads/edit.py

@@ -184,11 +184,12 @@ def build_edit_cmd(src: Path, dest: Path, spec: dict, out_ext: str) -> list[str]
 def _concat_quote(path: Path) -> str:
     """Escape a path for a single-quoted `file '…'` line of an ffmpeg concat list.
 
-    The demuxer's own rule: inside single quotes a literal `'` is written `'\\''` (close, escaped
-    quote, reopen) and a `\\` must be doubled. On-disk names have been ASCII-slugged since 0.51.0,
-    but that change is FORWARD-ONLY — a pre-0.51.0 file still on disk can be named `Don't_….mp4`,
-    and an unescaped apostrophe there makes the whole list unparseable."""
-    return path.as_posix().replace("\\", "\\\\").replace("'", "'\\''")
+    ffmpeg's quoting rule: inside single quotes EVERY character is literal except `'` itself, which
+    is written `'\\''` (close the quote, emit an escaped quote, reopen). Backslashes are literal
+    there — doubling them would corrupt a path that contains one. On-disk names have been
+    ASCII-slugged since 0.51.0, but that change is FORWARD-ONLY: a pre-0.51.0 file still on disk can
+    be named `Don't_….mp4`, and an unescaped apostrophe makes the whole list unparseable."""
+    return path.as_posix().replace("'", "'\\''")
 
 
 def build_concat_plan(src: Path, dest: Path, spec: dict, out_ext: str, staging: Path):