fix(api): a paused viewer keeps its HLS session, a refused subtitle publish backs off, and a NUL is a 422 everywhere

Deep-review round 4, backend half.

- The periodic HLS reaper (round 3) applied the "finished and unfetched for 30 s" rule that only a
  NEW session request may apply. A remux finishes long before the film, and a paused player with a
  full buffer fetches nothing, so a one-minute pause killed the session and playback died ~30 s after
  resuming. The periodic pass is `reap_abandoned` now (the long idle limit, finished or not).
- A subtitle `publish` that could not keep its output (full / read-only cache volume) returned
  quietly, so every poll queued the window and the whole-container pass again. It reports failure
  and the pass is backed off like a failed read; a cached VTT that cannot be READ is answered
  `unavailable` (`cache_unreadable`) instead of scheduling reads that can never land.
- The subtitle routes bound `rating_key` / `sub_ord` (they become a cache file name: a 250-digit
  one was ENAMETOOLONG, which pathlib's exists() re-raises -> a 500), and the cache helpers no longer
  throw on such a name.
- One app-wide handler turns psycopg's "text fields cannot contain NUL" DataError into a 422: round 3
  guarded only the by-rating_key lookup, and `contains=`, `contains_group=`, reorder/bulk key lists
  and the collection search still 500'd.
- The hand-written `db.get(...) is None -> 404 "Unknown ..."` siblings use `get_or_404` with a
  `what` (channel / video / user), so the Hungarian UI no longer shows English for a gone row.

backend/app/plex/subtitles.py

@@ -207,7 +207,17 @@ def read_meta(key: str) -> tuple[list[list[float]], bool]:
         raw = json.loads(_meta_path(key).read_text(encoding="utf-8"))
         return [[float(a), float(b)] for a, b in raw.get("ranges", [])], bool(raw.get("complete"))
     except (OSError, ValueError, TypeError):
-        return ([[0.0, _FULL_END_S]], True) if _vtt_path(key).exists() else ([], False)
+        return ([[0.0, _FULL_END_S]], True) if _exists(_vtt_path(key)) else ([], False)
+
+
+def _exists(p: Path) -> bool:
+    """`Path.exists` that answers False for a path the OS refuses outright: pathlib swallows only
+    ENOENT-like errors, so an over-long name (ENAMETOOLONG, from an absurd rating_key or ordinal)
+    escaped as a 500 from the status route."""
+    try:
+        return p.exists()
+    except (OSError, ValueError):
+        return False
 
 
 def _write_meta(key: str, ranges: list[list[float]], complete: bool) -> None:
@@ -305,8 +315,11 @@ def _last_cue_end(vtt: str) -> float:
     return end
 
 
-def publish(key: str, vtt: str, covered: tuple[float, float], complete: bool) -> None:
-    """Merge a freshly extracted region into the cached track and widen its covered ranges.
+def publish(key: str, vtt: str, covered: tuple[float, float], complete: bool) -> bool:
+    """Merge a freshly extracted region into the cached track and widen its covered ranges. False
+    when the region did not land (the cache is unwritable, or the VTT there cannot be read) — the
+    caller must then record a FAILED pass: returning quietly let the next poll schedule the same read
+    again, a whole-container pass every time, while the player said "preparing" for good.
 
     A read-merge-write, so it runs under `_PUBLISH_LOCK`: two jobs publish into the same keys (a
     window and the full pass, and every embedded track of the file rides each of them), and without
@@ -319,7 +332,7 @@ def publish(key: str, vtt: str, covered: tuple[float, float], complete: bool) ->
             # There, but unreadable (`cache_read` swallows the OSError). Merging into "" would replace
             # a whole track with this one region while its sidecar still claimed all of it.
             log.warning("subtitle cache %s unreadable; not publishing into it", key)
-            return
+            return False
         old_ranges, was_complete = read_meta(key)
         if old is None:
             # A sidecar with no VTT behind it claims cues that are not there, so it is not merged
@@ -330,8 +343,10 @@ def publish(key: str, vtt: str, covered: tuple[float, float], complete: bool) ->
             old_ranges, was_complete = [], False
             _write_meta(key, [], False)
         if not cache_write(key, merge_vtt(old or "", vtt)):
-            return  # the region never landed, so the sidecar must not claim it
+            log.warning("subtitle cache %s could not be written", key)
+            return False  # the region never landed, so the sidecar must not claim it
         _write_meta(key, merge_ranges(old_ranges + [list(covered)]), complete or was_complete)
+        return True
 
 
 # --- background extraction ----------------------------------------------------------------------
@@ -531,6 +546,12 @@ def ensure(rating_key: str, sub_ord: int, at: float = 0.0) -> dict:
     gen = generation(key)
     if complete and have:
         return {"state": "ready", "code": None, "gen": gen}
+    if not have and _exists(_vtt_path(key)):
+        # On disk but unreadable (permissions, a bad volume): nothing can serve it, and no extraction
+        # can help — `publish` refuses to merge into it, and a job whose sidecar covers the position
+        # skips as already done — so scheduling only kept the player on "preparing" for good. `gen` 0:
+        # there is nothing a <track> could fetch.
+        return {"state": "unavailable", "code": "cache_unreadable", "gen": 0}
     code = _recent_failure(key)
     if code and not covered:
         return {
@@ -616,7 +637,7 @@ def _already_done(key: str, window_start: float | None, at: float) -> bool:
     """A queued job looks again before it reads anything. While it waited, another job may have
     covered it: every embedded track rides each pass over its file, so a window for one language also
     publishes the others."""
-    if not _vtt_path(key).exists():
+    if not _exists(_vtt_path(key)):
         return False
     ranges, complete = read_meta(key)
     return complete or (window_start is not None and covers(ranges, at))
@@ -696,7 +717,8 @@ def _extract_and_publish(rating_key: str, sub_ord: int, window_start: float | No
             # identity is per ITEM (the embedded fan-out shares it), so a sidecar picked while an
             # embedded track's full pass was running sat behind that pass for minutes.
             vtt = _sidecar_vtt(db, want)
-            publish(cache_key(rating_key, sub_ord), vtt, (0.0, _FULL_END_S), True)
+            if not publish(cache_key(rating_key, sub_ord), vtt, (0.0, _FULL_END_S), True):
+                raise SubtitleUnavailable("extract_failed")
             return
         if want.get("index") is None:
             raise SubtitleUnavailable("not_fetchable")
@@ -721,13 +743,16 @@ def _extract_and_publish(rating_key: str, sub_ord: int, window_start: float | No
         # the track read "ready" for good while its subtitles stopped wherever ffmpeg did (the cache
         # has no eviction, so nothing would ever have extracted it again).
         covered_end = end if clean else start + _last_cue_end(vtt)
-        publish(
+        landed = publish(
             key,
             shift_vtt(vtt, -start),  # zero-based window clock → absolute cue times
             (start, covered_end),
             clean and length is None,
         )
-        if not clean:
+        if not landed:
+            # A read that could not be kept is a failed read (see publish) — backed off like one.
+            _pass_failed(rating_key, [key], window_start, (start, end))
+        elif not clean:
             _pass_failed(rating_key, [key], window_start, (covered_end, end))