fix(downloads): shell-safe names, refresh display_name on re-download, GC orphan sweep

Follow-up to user prod testing of 0.51.0:
- re-download now clears job.display_name so the card title + Content-Disposition filename are
  re-derived from the freshly-cleaned title (previously an auto-name from an older un-cleaned
  title — still carrying a "… views · … reactions |" prefix — survived the rebuild).
- on-disk AND served names are now a strict shell-safe slug: only [A-Za-z0-9._-] survive; every
  other char (the "!" the user saw, plus ( ) [ ] & $ ' " ; | ? * …) collapses to "_". The id no
  longer uses [brackets] (glob metacharacters). Shared _slug helper for sanitize + display_filename.
- GC gains a 5th pass: sweep on-disk files/dirs no ready asset owns (old accented channel dirs, a
  poster from a superseded naming scheme left after a re-download), skipping the dot system trees
  and anything newer than an hour so an in-flight download is never touched.
- Tests: slug strips !/$/()[]; rel_path is bracket-free; orphan-sweep keeps owned/system/fresh files.

backend/tests/test_naming.py

@@ -47,6 +47,17 @@ def test_rel_path_is_ascii_everywhere():
     rel = storage.rel_path(meta, "mp4", "plex", asset_id=7)
     assert _is_ascii_slug(rel.replace("/", ""))
     assert "Hajdu_Balazs" in rel and "Aristom_Odon" in rel
+    # Shell-unpleasant chars (incl. the id brackets) never appear in a generated path.
+    for bad in "[]!?*&$()'\"; |":
+        assert bad not in rel
+
+
+def test_rel_path_strips_exclamation_and_other_shell_chars():
+    meta = storage.MediaMeta(
+        video_id="abc123", title="Rovinjból! A vihar (2026) $$$", uploader="Chan", upload_date=None
+    )
+    rel = storage.rel_path(meta, "mp4", "plex", asset_id=1)
+    assert "!" not in rel and "$" not in rel and "(" not in rel
 
 
 def test_engagement_prefix_stripped():