fix(downloads): shell-safe names, refresh display_name on re-download, GC orphan sweep

Follow-up to user prod testing of 0.51.0:
- re-download now clears job.display_name so the card title + Content-Disposition filename are
  re-derived from the freshly-cleaned title (previously an auto-name from an older un-cleaned
  title — still carrying a "… views · … reactions |" prefix — survived the rebuild).
- on-disk AND served names are now a strict shell-safe slug: only [A-Za-z0-9._-] survive; every
  other char (the "!" the user saw, plus ( ) [ ] & $ ' " ; | ? * …) collapses to "_". The id no
  longer uses [brackets] (glob metacharacters). Shared _slug helper for sanitize + display_filename.
- GC gains a 5th pass: sweep on-disk files/dirs no ready asset owns (old accented channel dirs, a
  poster from a superseded naming scheme left after a re-download), skipping the dot system trees
  and anything newer than an hour so an in-flight download is never touched.
- Tests: slug strips !/$/()[]; rel_path is bracket-free; orphan-sweep keeps owned/system/fresh files.

backend/app/routes/downloads.py

@@ -489,6 +489,10 @@ def redownload_download(
     job.error = None
     job.speed_bps = None
     job.eta_s = None
+    # Re-derive the display name (card title + Content-Disposition filename) from the freshly
+    # cleaned title — otherwise a name auto-set from an older, un-cleaned title (e.g. still carrying
+    # a "1.6M views · … |" social prefix) would survive the rebuild. The worker fills it on completion.
+    job.display_name = None
     job.queue_pos = service.next_queue_pos(db)  # tail of the queue, not its stale original slot
     db.commit()
     return _serialize_job(db, job)