build(backend): close the lint gaps the E32 audit measured

ruff gains RUF100, PLW1510 and flake8-bugbear, every hit fixed rather than
ignored. B008 stays on with FastAPI's Depends/Query declared immutable.
basedpyright moves to standard mode, pytest to --strict-markers, and a hand
run of pytest now requires the database unless SIFTLODE_TEST_REQUIRE_DB=0.

PLW1510 found a real bug: the three ffprobe probes in plex/stream.py never
looked at the exit status, so a probe that failed was read as the file's
truth (an HDR source sent down the HW-safe path, a multi-audio file collapsed
to one track, a subtitle offset taken from garbage) and the warning each
except branch promises never fired. They now run with check=True.

backend/tests/test_plex_stream.py

@@ -8,6 +8,7 @@ Since the sweep stopped being awaited at startup it also runs CONCURRENTLY with
 second half of this file pins what keeps it off a LIVE session's segments."""
 
 import os
+import sys
 from pathlib import Path
 
 import pytest
@@ -830,6 +831,46 @@ class TestProbeVideoKind:
         assert stream._probe_video_kind(Path("/x")) == stream._VK_HWSAFE
 
 
+class TestProbeExitStatus:
+    """A probe whose ffprobe EXITS NON-ZERO is a failed probe, not an answer (E32). Each probe used to
+    read stdout without looking at the exit status, so a refusing ffprobe silently picked the fallback
+    — HW-safe, single audio, the requested offset — and skipped the warning its except branch promises.
+    Drives the REAL subprocess.run with the probe's own kwargs against a stand-in command that prints a
+    plausible answer and then fails, so the test fails whenever the exit status is ignored."""
+
+    @staticmethod
+    def _failing_ffprobe(monkeypatch, stdout: str):
+        real_run = stream.subprocess.run
+        script = f"import sys; sys.stdout.write({stdout!r}); sys.exit(1)"
+        monkeypatch.setattr(
+            stream.subprocess,
+            "run",
+            lambda _cmd, **kw: real_run([sys.executable, "-c", script], **kw),
+        )
+
+    @staticmethod
+    def _events(caplog) -> list[str]:
+        return [getattr(r, "event", "") for r in caplog.records]
+
+    def test_video_kind(self, monkeypatch, caplog):
+        self._failing_ffprobe(monkeypatch, "pix_fmt=yuv420p10le\ncolor_transfer=smpte2084\n")
+        with caplog.at_level("INFO"):
+            assert stream._probe_video_kind(Path("/x")) == stream._VK_HWSAFE
+        assert "plex.stream.probe_kind_failed" in self._events(caplog)
+
+    def test_audio_langs(self, monkeypatch, caplog):
+        self._failing_ffprobe(monkeypatch, "hun\neng\n")
+        with caplog.at_level("INFO"):
+            assert stream._probe_audio_langs(Path("/x")) == []
+        assert "plex.stream.probe_audio_failed" in self._events(caplog)
+
+    def test_first_pts(self, monkeypatch, caplog):
+        self._failing_ffprobe(monkeypatch, "12.5\n")
+        with caplog.at_level("INFO"):
+            assert stream._probe_first_pts(Path("/x")) is None
+        assert "plex.stream.first_pts_probe_failed" in self._events(caplog)
+
+
 class TestOpenclPresent:
     """The OpenCL-runtime probe (_opencl_present) — the precondition for the HW HDR tonemap graph. Drives
     the REAL glob against a temp ICD dir instead of monkeypatching the function, so a regression to the