feat(offline): play downloaded video, and drain the offline sync queue (0.4.6)

Bundles this session's work plus the concurrent search/offline/player changes.
Every gate passes on the combined tree: 885 frontend tests, 610 Rust tests,
clippy clean, boundary clean, trace coverage 86%.

Offline video playback — four separate defects, each of which alone stopped it:

  DR-133  A completed download's file_path is already absolute (the worker
          rewrites it on completion), but the player rooted it a second time and
          handed the webview /data/user/0/app//data/user/0/app/videos/x.mp4.
  DR-134  The asset protocol was never enabled: no protocol-asset feature and no
          assetProtocol config, so convertFileSrc produced URLs nothing answered.
          Also silently defeated the cached-thumbnail path, which fails soft to
          the server copy and hid it whenever the server was reachable.
  DR-137  Tauri's asset protocol answers a range-less request by reading the
          whole file into memory, and only advertises Accept-Ranges from inside
          its range branch, so the first request never learns ranges exist.
          Chromium gave up with PIPELINE_ERROR_READ after ~31s. Local media is
          now served by a loopback HTTP server: bounded 4 MiB chunks streamed
          from the file handle, every response length-delimited, and a range-less
          request answered with one chunk rather than the file. Confined by a
          per-session token and to the app data directory, because loopback is
          shared between apps on Android.
  DR-138  Release builds set usesCleartextTraffic=false, so Android rejected the
          request to that server before any I/O. A network-security-config
          exempts 127.0.0.1 only; a remote server must still be HTTPS.

Downloads:

  DR-135  download_item never records media_type and the reconnect resolver read
          that NULL as 'audio', so a movie queued from a media card had its URL
          resolved by get_audio_stream_url and completed as an audio-only
          transcode. The item's own type now decides.
  DR-136  Rows already downloaded that way are requeued on reconnect, since
          prevention alone leaves them reading "downloaded" and still unplayable.

Known limitation: a download taken at `original` quality is a byte copy of the
source, so it can be any container. One such file is an AVI holding XVID, which
the webview cannot play in any case — the media server serves it correctly and
Chromium refuses it. That needs either a transcoded download preset or the
native ExoPlayer surface work, and is not addressed here.

Also fixes two ID collisions between concurrent work: DR-143 defined twice
(search vs offline gate) and UT-131 defined twice (Episode Focus hero vs channel
cap). The search requirement is now DR-147 and the channel-cap test UT-141, with
their code references and matrix rows updated.

scripts/extract-traces.test.ts

@@ -25,8 +25,8 @@ describe("countDefinedRequirements", () => {
 | UR-002 | Access media when online or offline | High | Done |
 `;
     const defined = countDefinedRequirements(md);
-    expect(defined.UR).toBe(71);
-    expect(defined.DR).toBe(131);
+    expect(defined.UR).toBe(2);
+    expect(defined.DR).toBe(0);
   });
 
   it("does not count IDs that appear only in the Traces To column", () => {
@@ -38,9 +38,9 @@ describe("countDefinedRequirements", () => {
 | DR-002 | MediaItem struct | Player | UR-003, UR-004 | Done |
 `;
     const defined = countDefinedRequirements(md);
-    expect(defined.DR).toBe(131);
+    expect(defined.DR).toBe(2);
     // UR-005/UR-003/UR-004 are referenced, never defined here.
-    expect(defined.UR).toBe(71);
+    expect(defined.UR).toBe(0);
   });
 
   it("does not count IDs mentioned in prose", () => {
@@ -50,9 +50,9 @@ Some prose explaining that UR-005 relates to DR-001 and JA-002.
 | UR-005 | Control media playback | High | Done |
 `;
     const defined = countDefinedRequirements(md);
-    expect(defined.UR).toBe(71);
-    expect(defined.DR).toBe(131);
-    expect(defined.JA).toBe(34);
+    expect(defined.UR).toBe(1);
+    expect(defined.DR).toBe(0);
+    expect(defined.JA).toBe(0);
   });
 
   it("deduplicates an ID listed in both the spec table and the traceability matrix", () => {
@@ -69,7 +69,7 @@ Some prose explaining that UR-005 relates to DR-001 and JA-002.
 | UR-006 | - | DR-012 |
 `;
     const defined = countDefinedRequirements(md);
-    expect(defined.UR).toBe(71);
+    expect(defined.UR).toBe(2);
   });
 
   it("collects the defined ID set, not just counts", () => {
@@ -175,8 +175,8 @@ describe("live requirements.md", () => {
 
     expect(defined.UR).toBe(71);
     expect(defined.IR).toBe(32);
-    expect(defined.DR).toBe(131);
-    expect(defined.JA).toBe(34);
-    expect(defined.total).toBe(268);
+    expect(defined.DR).toBe(142);
+    expect(defined.JA).toBe(35);
+    expect(defined.total).toBe(280);
   });
 });

scripts/sync-android-sources.sh

@@ -87,6 +87,16 @@ if [ -d "$RES_SRC" ]; then
         cp "$RES_SRC"/values/*.xml "$RES_DST/values/"
         echo "  Copied res: values"
     fi
+
+    # xml/ (network_security_config.xml): referenced from the manifest, so a
+    # missing copy fails the resource link rather than degrading quietly.
+    # Merged into Tauri's generated xml/ (which holds file_paths.xml) rather
+    # than replacing it.
+    if [ -d "$RES_SRC/xml" ]; then
+        mkdir -p "$RES_DST/xml"
+        cp "$RES_SRC"/xml/*.xml "$RES_DST/xml/"
+        echo "  Copied res: xml"
+    fi
     # We ship only the color adaptive icon (background + foreground). Drop any
     # monochrome layer Tauri may generate: the themed-icon monochrome doesn't
     # render well, and our adaptive-icon xml no longer references it, so a stray