refactor: R12 S3 — invert scheduler->routes, publish cross-module privates

Layering cleanup, no behaviour change (ruff clean backend+scripts, pytest 193):

- Invert the scheduler->routes dependency: reset_demo_state (+ its demo-seed
  helpers) move from routes/admin.py to a new service module app/demo.py.
  Both routes/admin.py and scheduler.py now import it from app.demo, so the
  scheduler no longer reaches into the routes layer — its lazy import (the
  routes<->scheduler cycle workaround) is gone, hoisted to a top-level import.

- Publish the private symbols that were imported across module boundaries (the
  underscore convention was lying): feed._serialize -> serialize,
  feed._to_tsquery_str -> to_tsquery_str, videos._insert_stubs -> insert_stubs,
  videos._stub_from_playlist_item -> stub_from_playlist_item,
  worker._uploader_url -> uploader_url, plex._shared._item_or_404 ->
  item_or_404. Scoped renames — the 5 other route modules keep their own truly
  private _serialize helpers.

- _release_asset moves from routes/downloads.py to app/downloads/service.py as
  the public release_asset (asset bookkeeping is a service concern); the routes
  call it via service.release_asset.

backend/app/downloads/backfill.py

@@ -21,7 +21,7 @@ from app.db import SessionLocal
 from app.downloads import edit as editmod
 from app.downloads import formats, service
 from app.models import MediaAsset
-from app.worker import _uploader_url
+from app.worker import uploader_url
 
 log = logging.getLogger("siftlode.backfill")
 
@@ -73,7 +73,7 @@ def run() -> dict:
             if a.uploader_url is None and _should_refetch(a):
                 url = a.source_webpage_url or service.source_url(a.source_kind, a.source_ref)
                 info = _extract_meta(url)
-                uu = _uploader_url(info) if info else None
+                uu = uploader_url(info) if info else None
                 if uu:
                     a.uploader_url = uu
                     filled_url += 1