fix(downloads): harden upload serving + ingest against stored-XSS and leaks (E7 review)

Deep-review remediation for the E7 upload path, all findings adversarially verified:

- Serve every library file with a Content-Type chosen from the ffprobe-verified media_kind
  + a strict container allow-list (storage.served_media_type), never guessed from the
  user-controlled file extension. Closes a stored-XSS vector where a media/HTML polyglot
  uploaded as "evil.html" was served inline as text/html on the login-free /watch surface.
  Applied to both the authenticated /file and the public watch_file endpoints.
- Classify uploaded still images (jpg/png/gif/webp/…) as media_kind='file' so they are
  force-downloaded and don't get a broken in-app video player.
- Roll back the on-disk side of an upload when the ingest transaction fails after place_file
  (unlink the placed file + its deterministic poster path), so a failed commit can't orphan
  bytes in the GC-skipped .uploads tree.
- Floor download_upload_max_bytes at min=1 so a stored 0 can't silently disable the per-file cap.
- Dedupe the ffprobe-JSON invocation into edit.run_ffprobe_json (shared by probe_codecs and
  upload._probe) and the upload extension into storage._clean_upload_ext; drop the now-unused
  parse_probe_streams.

Tests: public + authenticated force-download and the polyglot-not-served-as-HTML guard, the
real _probe classifier (image/cover-art/dims/duration), the ingest rollback/cleanup path, the
max_jobs branch, the cap-floor invariant, and run_ffprobe_json error handling.

backend/app/routes/downloads.py

@@ -26,7 +26,6 @@ from app.db import get_db
 from app.downloads import credentials as dlcreds
 from app.downloads import edit as editmod
 from app.downloads import links as linksmod
-from app.downloads import mediakind
 from app.downloads import quota, service, storage
 from app.downloads import upload as uploadmod
 from app.models import (
@@ -675,17 +674,21 @@ def download_file(
 
     asset.last_access_at = datetime.now(timezone.utc)
     db.commit()
-    # A generic uploaded file is served as a neutral, force-download attachment — never with a
-    # sniffable content-type — so uploaded HTML/SVG can't execute inline on this origin. Media keeps
-    # its guessed type so the in-app player streams it. Both are range-aware (FileResponse → 206).
-    if asset.media_kind == mediakind.FILE:
+    # The served Content-Type comes from the ffprobe-verified media_kind + a container allow-list
+    # (storage.served_media_type), NEVER guessed from the file's own extension. A generic 'file' (and
+    # any media whose container we don't recognise — e.g. a media/HTML polyglot named "evil.html")
+    # returns None → a neutral force-download attachment, so uploaded HTML/SVG can't execute inline on
+    # this origin. Recognised media is served with its real type so the in-app player streams it. Both
+    # are range-aware (FileResponse → 206).
+    media_type = storage.served_media_type(asset.media_kind, asset.container)
+    if media_type is None:
         return FileResponse(
             path,
             filename=filename,
             media_type="application/octet-stream",
             content_disposition_type="attachment",
         )
-    return FileResponse(path, filename=filename)
+    return FileResponse(path, filename=filename, media_type=media_type)
 
 
 # --- editor filmstrip (scrub track) --------------------------------------------------------

backend/app/routes/public.py

@@ -15,7 +15,7 @@ from sqlalchemy.orm import Session
 from app.config import settings
 from app.db import get_db
 from app.downloads import links as linksmod
-from app.downloads import mediakind, storage
+from app.downloads import storage
 from app.models import DownloadJob, DownloadLink, MediaAsset
 from app.ratelimit import RateLimiter
 from app.security import verify_password
@@ -122,11 +122,15 @@ def watch_file(token: str, g: str | None = None, db: Session = Depends(get_db)):
         raise HTTPException(status_code=404, detail="This video is no longer available.")
 
     filename = storage.download_filename(asset.title or "video", asset.container, path)
-    # A generic uploaded file (media_kind='file') is ALWAYS a force-download attachment with a
-    # neutral type — never served inline — so arbitrary uploaded HTML/SVG can't execute on this
-    # login-free public origin. Media follows the link's own inline/attachment choice so it can play
+    # The served Content-Type comes from the asset's ffprobe-verified media_kind + a container
+    # allow-list (storage.served_media_type) — NEVER guessed from the file's own extension. A generic
+    # 'file' (and any media whose container we don't positively recognise, e.g. a media/HTML polyglot
+    # named "evil.html") returns None → a neutral force-download attachment, so arbitrary uploaded
+    # HTML/SVG can't execute inline on this login-free public origin. A recognised media container is
+    # served with its real audio/video type, inline unless the link forces a download so it can play
     # in the watch page. Both are range-aware (FileResponse → 206) for seeking/resume.
-    if asset.media_kind == mediakind.FILE:
+    media_type = storage.served_media_type(asset.media_kind, asset.container)
+    if media_type is None:
         return FileResponse(
             path,
             filename=filename,
@@ -134,7 +138,9 @@ def watch_file(token: str, g: str | None = None, db: Session = Depends(get_db)):
             content_disposition_type="attachment",
         )
     disposition = "attachment" if link.allow_download else "inline"
-    return FileResponse(path, filename=filename, content_disposition_type=disposition)
+    return FileResponse(
+        path, filename=filename, media_type=media_type, content_disposition_type=disposition
+    )
 
 
 @router.get("/watch/{token}/poster.jpg")