fix(r5): address the third /code-review high round — 7 findings

- the sweep guard anchors the rating_key to digits: the round-2 widening had
  degenerated to "anything ending in _<digits>" (backup_2024, release_10)
- RSS counts apply-side failures too, so a read-only database no longer reports
  a wholly failed poll as "ok — new=0, failed=0"
- the player reads/writes its volume directly (readAccount/writeAccount): the
  persisted-object hook rendered nothing and cost a second write per settle
- new tests: the sweep guard's accept/reject table, and run_ffmpeg's threading
  (drain, cancel while silent, stall watchdog, stderr tail on a nonzero exit)
- the breaker sentinel is checked one way (isinstance) at all four sites
- run_rss_poll is typed dict[str, int]

All three new test groups were mutation-checked: reverting each fix turns them
red (or, for the cancel/stall pair, hangs — which is the bug itself).

backend/app/plex/stream.py

@@ -35,12 +35,18 @@ _HLS_ROOT = Path(settings.plex_hls_dir) if settings.plex_hls_dir else Path(setti
 _SEG_SECONDS = 6
 _SESSION_IDLE_S = 600  # reap a session with no access for this long
 # A session directory is named `{rating_key}_{int(start_s)}_{tag}_{aoff:+.2f}` (see start_session);
-# before multi-audio it was just `{rating_key}_{int(start_s)}`, so the tail is OPTIONAL here — the
-# oldest leftovers on disk carry the old shape and are exactly what the sweep exists to remove.
-# `sweep_orphans` deletes ONLY names matching this: `_HLS_ROOT` is admin-configurable
-# (PLEX_HLS_DIR), so it may legitimately point at a shared scratch path we do not own — a blanket
-# "delete every directory under the root" would take the neighbours with it.
-_SESSION_DIR_RE = re.compile(r"^.+_\d+(_[^_]+_[+-]\d+\.\d{2})?$")
+# before multi-audio it was just `{rating_key}_{int(start_s)}`. `sweep_orphans` deletes ONLY names
+# matching one of those two shapes: `_HLS_ROOT` is admin-configurable (PLEX_HLS_DIR), so it may
+# legitimately point at a shared scratch path we do not own, and a blanket "delete every directory
+# under the root" would take the neighbours with it.
+#
+# The KEY is anchored to digits (a Plex rating_key is a number) — that is what keeps foreign names
+# out. A `.+` there let `snapshot_2024_backup_+1.00` through, and pairing `.+` with an optional tail
+# degenerated all the way to "anything ending in _<digits>" (`backup_2024`, `release_10`). A
+# non-numeric rating_key would merely leave its directory unswept, which is the safe direction to
+# fail. Covered by test_plex_stream.py — this regex is the only thing standing between the sweep
+# and someone else's data.
+_SESSION_DIR_RE = re.compile(r"^\d+_\d+(_[^_]+_[+-]\d+\.\d{2})?$")
 
 _lock = threading.Lock()
 _sessions: dict[str, "HlsSession"] = {}