fix(downloads): a row whose remote picture fails too falls back to its glyph

The remote thumbnail was the last resort with no fallback of its own, so a dead CDN link drew the
browser's broken-image mark. A failed remote URL is remembered like a failed poster, and the row
shows its film / music glyph.

frontend/src/components/downloadRow.tsx

@@ -94,7 +94,12 @@ function Thumb({ job }: { job: DownloadJob }) {
   // back, not written off for the life of the recycled slot. Convergent, so it belongs in render.
   const [failedPrimary, setFailedPrimary] = useState<string | null>(null);
   if (failedPrimary !== null && failedPrimary !== primary) setFailedPrimary(null);
-  const src = failedPrimary && failedPrimary === primary ? remote : primary;
+  // The remote picture is the last resort, and it fails too (a dead CDN link): remembered the same
+  // way, so the row falls to the glyph below instead of the browser's broken-image mark (E28 C5).
+  const [failedRemote, setFailedRemote] = useState<string | null>(null);
+  if (failedRemote !== null && failedRemote !== remote) setFailedRemote(null);
+  const candidate = failedPrimary && failedPrimary === primary ? remote : primary;
+  const src = candidate && candidate === failedRemote ? null : candidate;
   // A generic uploaded file (media_kind='file') has no video frame to poster — it's a document/
   // archive, not playable media. Show a neutral file glyph instead of an (always-empty) thumbnail.
   if (job.asset?.media_kind === "file") {
@@ -114,6 +119,7 @@ function Thumb({ job }: { job: DownloadJob }) {
           className="w-full h-full object-cover"
           onError={() => {
             if (src !== remote) setFailedPrimary(primary);
+            else setFailedRemote(remote);
           }}
         />
       ) : (