refactor(capture): the HTTP layer reads through queries and writes through the service

Capture's routes (downloads, files, public watch links) and the token list no longer build SQL, call
the session or set a model's fields: reads are downloads/queries, writes the unit's service (service,
folders, links, quota), and each write flushes for the handler to commit. Whose a row is goes
through userscope (owned_by, owned_row), which owned_or_404 now uses too.

The fence holds Capture below its routes as well: it reads only Catalog's and Plex's tables, writes
no other unit's, filters owners through userscope and commits only in its jobs and the upload
ingest. A test per service use case, among them that the tray lists only the caller's files.

frontend/src/lib/api/files.contract.test.ts

@@ -10,6 +10,11 @@ import { FILE_SORTS, FILES_LIST_CAP, listQuery } from "./files";
 // matches everything. The route's parameter names are read from its source, as text — the backend
 // cannot be imported here.
 const routes = readFileSync(resolve(__dirname, "../../../../backend/app/routes/files.py"), "utf-8");
+// The cap is the query's (backend downloads/queries.py), which the route lists through.
+const queries = readFileSync(
+  resolve(__dirname, "../../../../backend/app/downloads/queries.py"),
+  "utf-8",
+);
 
 function routeParams(): Map<string, string> {
   const sig = routes.match(/^def list_files\(([\s\S]*?)\) -> /m);
@@ -43,8 +48,8 @@ describe("the Files list's request", () => {
 
   it("knows the cap the route lists up to", () => {
     // A list as long as the cap may be missing older files; the page then searches on the server.
-    const cap = routes.match(/^MAX_LIST = (\d+)$/m);
-    expect(cap, "routes/files.py no longer defines MAX_LIST").toBeTruthy();
+    const cap = queries.match(/^MAX_LIST = (\d+)$/m);
+    expect(cap, "downloads/queries.py no longer defines MAX_LIST").toBeTruthy();
     expect(FILES_LIST_CAP).toBe(Number(cap![1]));
   });
 });