fix(e3): address /code-review high findings (5)

Round-1 review fixes on the E3 branch:

- prune partial-fetch (correctness): `_paginate` now reports whether it reached
  the server's reported `total`; `_prune_stale` prunes only on a COMPLETE
  non-empty listing. A truncated fetch (a mid-sequence empty/short page before
  total — a transient Plex hiccup) no longer deletes the rows it merely failed
  to list. New test: a listing that claims 5 but returns 1 prunes nothing.
- `_prune_stale` (robustness): `stats.get("pruned", 0) + 1` — no KeyError when a
  caller's stats dict omits the key.
- service transitions (conventions): pause/resume/redownload use the JobStatus
  StrEnum instead of loose "queued"/"paused"/"error" literals, matching cancel.
- ffmpeg progress writer (correctness): a stuck-percent heartbeat now runs on its
  OWN 1/interval budget, so it can't consume the progress-write slot and delay a
  real percent change by up to an interval.
- backend/app/README.md (conventions): reword the transaction-ownership rule to
  quote and extend CLAUDE.md's canonical ("handler/job-wrapper commits; helpers
  flush; only quota owns its session") instead of stating a contradicting
  "helpers MAY commit" carve-out.

ruff clean, full DB-lane 364 pass.

backend/app/downloads/service.py

@@ -318,8 +318,8 @@ def release_asset(db: Session, job: DownloadJob) -> None:
 def pause(db: Session, job: DownloadJob) -> None:
     """Pause a queued/running job (a running worker aborts cooperatively via the cancel poll); a no-op
     in any other state."""
-    if job.status in ("queued", "running"):
-        job.status = "paused"
+    if job.status in (JobStatus.QUEUED, JobStatus.RUNNING):
+        job.status = JobStatus.PAUSED
         db.commit()
 
 
@@ -327,16 +327,16 @@ def resume(db: Session, job: DownloadJob) -> None:
     """Requeue a paused/errored job for a fresh attempt, clearing its error. If the SHARED asset itself
     failed, reset it to pending so the worker actually re-downloads — otherwise the requeued job would
     instantly re-inherit the asset's stale error (the worker short-circuits an errored asset)."""
-    if job.status in ("paused", "error"):
+    if job.status in (JobStatus.PAUSED, JobStatus.ERROR):
         job.progress = 0
         job.error = None
         job.error_code = None
         if job.asset_id:
             asset = db.get(MediaAsset, job.asset_id)
-            if asset and asset.status == "error":
+            if asset and asset.status == "error":  # MediaAsset.status (no enum), not a JobStatus
                 asset.status = "pending"
                 asset.error = None
-        job.status = "queued"
+        job.status = JobStatus.QUEUED
         db.commit()
 
 
@@ -370,7 +370,7 @@ def redownload(db: Session, job: DownloadJob) -> None:
     release_asset(db, job)
     incr_ref_count(db, asset.id)
     job.asset_id = asset.id
-    job.status = "queued"
+    job.status = JobStatus.QUEUED
     job.progress = 0
     job.phase = None
     job.error = None