fix(downloads): address code-review findings on the R2.5 mini-epic

- redownload: never clobber a co-held (deduped) asset. Drop the force-reset-to-pending;
  _release_asset already deletes+recreates a solo asset (genuine re-fetch), while a shared
  ready asset is left intact and the re-queued job re-points to it via _finish_from_cache —
  so one user's re-download can't delete another's file mid-serve (finding #1).
- redownload: reset queue_pos to the tail so a re-download doesn't front-run newer queued
  jobs on the worker's `ORDER BY queue_pos` claim (finding #3). Made service.next_queue_pos public.
- formats: video-only mp4 selector prefers every video-only option before any progressive
  `best`, so a "Video only" download stays audio-free whenever a video-only stream exists (#2).
- titles: a title that is only the engagement prefix no longer resurrects the stripped stats
  (return the stripped text / empty, not the raw) (#4).
- worker: probe the file's duration when yt-dlp gave none, so a long re-encode shows real
  progress instead of a frozen 0% (#5); tighten the ensure_browser_playable docstring to its
  actual mp4-profile scope (#6).

backend/app/worker.py

@@ -399,11 +399,12 @@ def _download_settings() -> tuple[str, int]:
 
 
 def _ensure_browser_playable(job_id: int, produced: Path, spec: dict, info: dict) -> Path:
-    """Guarantee the stored file plays in EVERY browser: H.264 + AAC/MP3 in mp4. If the download
-    (whatever the source shipped) isn't already that, re-encode the offending stream(s) — or just
-    remux when the codecs are fine but the container isn't. Gated on the mp4 compat profile, so an
-    explicit `vcodec` or non-mp4 custom profile opts out. Returns the file to store (converted, or
-    the original) and corrects `info`'s codec/container fields to match what's actually on disk."""
+    """Make an mp4-compat-profile download play in every browser: H.264 + AAC/MP3 in mp4. If the
+    download (whatever the source shipped) isn't already that, re-encode the offending stream(s) —
+    or just remux when the codecs are fine but the container isn't. **Scope:** only the mp4 compat
+    profile is normalized; an explicit `vcodec` or a non-mp4 custom profile is the user opting out
+    of the guarantee and is left as-is (so a `webm` profile can still ship VP9/Opus). Returns the
+    file to store (converted, or the original) and corrects `info`'s codec fields to match disk."""
     if spec.get("container") != "mp4" or spec.get("vcodec"):
         return produced
     vcodec, acodec = editmod.probe_codecs(produced)
@@ -416,9 +417,12 @@ def _ensure_browser_playable(job_id: int, produced: Path, spec: dict, info: dict
     action = "re-encode" if (reenc_v or reenc_a) else "remux"
     log.info("job %s: %s (v=%s a=%s mp4=%s) -> browser-safe mp4", job_id, action, vcodec, acodec, is_mp4)
     _set_job(job_id, phase="processing", progress=0, speed_bps=None, eta_s=None)
+    # Prefer the info duration; probe the file when the extractor didn't provide one, so a long
+    # re-encode still shows real progress instead of a frozen 0%.
+    total_s = int(info["duration"]) if info.get("duration") else editmod.probe_duration(produced)
     editmod.run_ffmpeg(
         editmod.build_browser_safe_cmd(produced, dest, reenc_v, reenc_a),
-        total_s=int(info["duration"]) if info.get("duration") else 0,
+        total_s=total_s,
         on_progress=lambda pct: _set_job(job_id, progress=int(pct), phase="processing"),
         should_cancel=lambda: _job_status(job_id) not in ("running", None),
     )