feat(offline): play downloaded video, and drain the offline sync queue (0.4.6)

Bundles this session's work plus the concurrent search/offline/player changes.
Every gate passes on the combined tree: 885 frontend tests, 610 Rust tests,
clippy clean, boundary clean, trace coverage 86%.

Offline video playback — four separate defects, each of which alone stopped it:

  DR-133  A completed download's file_path is already absolute (the worker
          rewrites it on completion), but the player rooted it a second time and
          handed the webview /data/user/0/app//data/user/0/app/videos/x.mp4.
  DR-134  The asset protocol was never enabled: no protocol-asset feature and no
          assetProtocol config, so convertFileSrc produced URLs nothing answered.
          Also silently defeated the cached-thumbnail path, which fails soft to
          the server copy and hid it whenever the server was reachable.
  DR-137  Tauri's asset protocol answers a range-less request by reading the
          whole file into memory, and only advertises Accept-Ranges from inside
          its range branch, so the first request never learns ranges exist.
          Chromium gave up with PIPELINE_ERROR_READ after ~31s. Local media is
          now served by a loopback HTTP server: bounded 4 MiB chunks streamed
          from the file handle, every response length-delimited, and a range-less
          request answered with one chunk rather than the file. Confined by a
          per-session token and to the app data directory, because loopback is
          shared between apps on Android.
  DR-138  Release builds set usesCleartextTraffic=false, so Android rejected the
          request to that server before any I/O. A network-security-config
          exempts 127.0.0.1 only; a remote server must still be HTTPS.

Downloads:

  DR-135  download_item never records media_type and the reconnect resolver read
          that NULL as 'audio', so a movie queued from a media card had its URL
          resolved by get_audio_stream_url and completed as an audio-only
          transcode. The item's own type now decides.
  DR-136  Rows already downloaded that way are requeued on reconnect, since
          prevention alone leaves them reading "downloaded" and still unplayable.

Known limitation: a download taken at `original` quality is a byte copy of the
source, so it can be any container. One such file is an AVI holding XVID, which
the webview cannot play in any case — the media server serves it correctly and
Chromium refuses it. That needs either a transcoded download preset or the
native ExoPlayer surface work, and is not addressed here.

Also fixes two ID collisions between concurrent work: DR-143 defined twice
(search vs offline gate) and UT-131 defined twice (Episode Focus hero vs channel
cap). The search requirement is now DR-147 and the channel-cap test UT-141, with
their code references and matrix rows updated.

src/routes/player/[id]/+page.svelte

@@ -2,7 +2,6 @@
   import { onMount, onDestroy } from "svelte";
   import { page } from "$app/stores";
   import { goto } from "$app/navigation";
-  import { convertFileSrc } from "@tauri-apps/api/core";
   import { commands } from "$lib/api/bindings";
   import { downloadedFilePath, resolveVideoSource } from "$lib/player/localSource";
   import type { PlayQueueRequest } from "$lib/api/bindings";
@@ -244,9 +243,13 @@
         const fullPath = downloadedFilePath(storagePath, localDownload.filePath);
         console.log("loadAndPlay: Full local path:", fullPath);
 
-        // Convert file path to asset URL that can be played in webview
-        const localUrl = convertFileSrc(fullPath);
-        console.log("loadAndPlay: Converted to asset URL:", localUrl);
+        // Serve the file over the loopback media server rather than the asset
+        // protocol: the asset protocol answers a range-less request with the
+        // entire file, so a downloaded film never finished loading. Rust mints
+        // the URL (it holds the port and the per-session token).
+        // TRACES: UR-071 | DR-137
+        const localUrl = await commands.mediaLocalUrl(fullPath);
+        console.log("loadAndPlay: Local media URL resolved");
 
         if (isVideo) {
           // Local video files don't need transcoding and support native seeking
@@ -310,12 +313,17 @@
           // at all offline. Rust returns null when nothing is downloaded or the
           // file has gone, so this falls back to the server on its own.
           // TRACES: UR-071 | DR-123
+          // A downloaded file is served over the loopback media server, not the
+          // asset protocol — see DR-137. The URL is minted up front because
+          // resolveVideoSource stays pure/synchronous.
+          // TRACES: UR-071 | DR-123, DR-137
           const localPath = await commands.playerLocalMediaPath(id);
+          const localUrl = localPath ? await commands.mediaLocalUrl(localPath) : null;
           const source = resolveVideoSource({
             localPath,
             remoteUrl: playbackInfo.streamUrl,
             remoteNeedsTranscoding: playbackInfo.needsTranscoding,
-            toAssetUrl: convertFileSrc,
+            toAssetUrl: () => localUrl ?? "",
           });
 
           streamUrl = source.url;