feat(health): classify playback impact of missing video segments

[javi11]

Summary

Health checks and streaming failures currently treat any missing Usenet segment as binary corruption — the file is marked corrupted/repair_triggered, its metadata is moved to the safety folder, and an ARR re-download is triggered, even when the missing segment only removes a couple of seconds of mid-stream video that a player would skip over. This adds container-aware classification so we can tell the difference.

• New internal/mediaprobe package — a pure, dependency-free io.ReaderAt-based prober. Walks MP4 top-level boxes (ftyp/moov/mdat/...) and MKV's EBML top level (header/Info/Tracks/Cues/Cluster), classifying missing byte ranges as:
  • fatal — overlaps a container-critical structure → unplayable → today's repair path.
  • degraded — only hits media payload (or MKV Cues, seek index only) → still playable, short glitch or broken seeking → no repair triggered.
  • unknown — non-video, encrypted, unparseable, or a critical region itself unreadable → treated as fatal (safe fallback).
• Probe timing: the container is mapped once during the already-scheduled immediate post-import health check (async health worker), not inline in the importer — nntppool drains full article bodies, so probing costs a handful of full downloads and must never slow down import. The resulting MediaStructure is persisted on FileMetadata; later failures classify offline with zero network reads, even in cases where the critical segment itself later goes missing (the live probe alone could never determine that). Pre-existing files fall back to a bounded, timeout-guarded lazy probe.
• Byte-range plumbing: usenet.ValidationResult now carries missing segments' file-coordinate byte ranges (prefix-sum of usable segment lengths); DataCorruptionError carries the failing offset so streaming failures can classify the same way.
• New degraded health status (DB migration 033, SQLite rebuild verified against the live schema + trigger/indexes) and FILE_STATUS_DEGRADED metadata status: degraded files stay visible and streamable (unlike corrupted, which hides/blocks them), skip ARR repair and the metadata safety-folder move, and are exempt from streaming-failure masking. A repair already in flight still wins over a later degraded verdict.
• Frontend: a playback-impact chip (Playable (glitch ~12:34–12:36) / Unplayable) on health table rows/cards, a Degraded stats card and filter option, excluded from the "requires action" alert count.
• Config knob health.media_probe_enabled (default true) disables probing entirely.
• Also fixes 4 pre-existing golangci-lint failures unrelated to this change (redundant type annotations in two files, dead context.WithValue string keys in the health checker replaced with structured slog attrs, an unused scanIDs helper).

Test plan

• internal/mediaprobe: ~34 table-driven cases with in-code MP4/MKV fixture builders (moov-at-end, 64-bit mdat, unknown-size Segment, Cues-before/after-Cluster, garbage headers, non-video extensions) — verified via a trackingReaderAt double that the walk never reads inside missing/media-payload ranges and stays within a small read budget.
• internal/usenet: missing-segment byte-range mapping (index + prefix-sum offsets, 50-entry cap) and SegmentsReaderAt (correct reads across segment boundaries, EOF handling, segment-cache dedup).
• internal/health: end-to-end health-checker integration tests over a fake NNTP pool — first-check structure persistence, no re-probe on subsequent checks, config-disabled probing, non-video/encrypted skip, degraded vs. fatal/unknown classification, and that stored-structure classification does zero downloads even when the critical segment is the one that died.
• internal/health/worker_degraded_test.go: prepareUpdateForResult decision table — degraded skips repair, in-flight repair wins over a later degraded verdict, fatal/unknown/no-classification follow the unchanged retry path.
• internal/database: migration 033 runs the full chain, accepts degraded, rejects unknown statuses, and confirms the SQLite table rebuild preserved the update trigger and every pre-existing index.
• go test -race ./... — full suite green.
• bun run check && bun run build — frontend typecheck/lint/build clean.
• make (generate, go mod tidy, golangci-lint, test-race) — green.