fix: harden download lifecycle, subscriptions, and UI robustness

Addresses a full-project review. Backend correctness and availability:

- ytdl: cancel() only SIGKILLs the child's process group when the child
  actually became its own group leader, so a race (or failed setpgrp)
  can no longer kill the whole server; kill the group on cancel and on
  shutdown to avoid orphaned ffmpeg children
- ytdl: dedicated ThreadPoolExecutor for download supervision so active
  downloads can't starve extract_info / live probes on the default pool
- ytdl/main/subscriptions: route fire-and-forget tasks through a
  bg_tasks helper that keeps a strong ref and logs failures
- subscriptions: run flat-playlist extraction in an executor and check
  feeds with bounded concurrency so one slow feed can't block the loop;
  set last_checked on failure so broken feeds aren't retried every 60s
- main: validate ids on /start & /delete and numeric env vars at startup;
  return 400 (not 500) on bad subscriptions/update input; serve /history
  from memory; move get_custom_dirs off the event loop; restrict t=
  stripping to YouTube hosts; drop double percent-decode in state guard
- dl_formats/ytdl: enforce requested caption format via
  FFmpegSubtitlesConvertor and strip VTT header metadata only in the
  pre-cue region so real dialogue is preserved
- ytdl: throttle progress events, dedup adds against pending, clear
  filename/size on error and reject out-of-dir trashcan deletes, pin
  fork start-method on Linux only

Frontend:

- retry deletes the done record only after a successful re-add
- surface HTTP errors for delete/start and reset the deleting flag
- ignore late 'updated' events for rows no longer in the queue
- track table rows by map key; FileSizePipe uses base-1024

Also: HTTPS-aware Docker healthcheck, dead-code removal, and shared
helpers for path-containment and yt-dlp option merging. Adds/updates
unit tests throughout (250 backend tests passing).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/tests/test_main_helpers.py

@@ -220,42 +220,61 @@ class ParseDownloadOptionsTests(unittest.TestCase):
 
     def test_clip_url_t_param_strips_query_and_sets_start(self):
         parsed = main.parse_download_options({
-            "url": "https://example.com/watch?v=1&t=855s",
+            "url": "https://www.youtube.com/watch?v=1&t=855s",
             "download_type": "video",
             "codec": "auto",
             "format": "any",
             "quality": "best",
         })
-        self.assertEqual(parsed["url"], "https://example.com/watch?v=1")
+        self.assertEqual(parsed["url"], "https://www.youtube.com/watch?v=1")
         self.assertEqual(parsed["clip_start"], 855.0)
         self.assertIsNone(parsed["clip_end"])
 
     def test_clip_explicit_start_wins_over_url_t(self):
         parsed = main.parse_download_options({
-            "url": "https://example.com/watch?v=1&t=100",
+            "url": "https://www.youtube.com/watch?v=1&t=100",
             "download_type": "video",
             "codec": "auto",
             "format": "any",
             "quality": "best",
             "clip_start": "50",
         })
-        self.assertEqual(parsed["url"], "https://example.com/watch?v=1")
+        self.assertEqual(parsed["url"], "https://www.youtube.com/watch?v=1")
         self.assertEqual(parsed["clip_start"], 50.0)
         self.assertIsNone(parsed["clip_end"])
 
     def test_clip_end_only_sets_start_zero_and_strips_url_t(self):
         parsed = main.parse_download_options({
-            "url": "https://example.com/watch?v=1&t=999",
+            "url": "https://www.youtube.com/watch?v=1&t=999",
             "download_type": "video",
             "codec": "auto",
             "format": "any",
             "quality": "best",
             "clip_end": "60",
         })
-        self.assertEqual(parsed["url"], "https://example.com/watch?v=1")
+        self.assertEqual(parsed["url"], "https://www.youtube.com/watch?v=1")
         self.assertEqual(parsed["clip_start"], 0.0)
         self.assertEqual(parsed["clip_end"], 60.0)
 
+    def test_clip_url_t_param_ignored_on_non_youtube_host(self):
+        # 't' is a generic query param name; only rewrite it on YouTube hosts
+        # so an unrelated site's URL isn't silently mutated with a bogus clip.
+        parsed = main.parse_download_options({
+            "url": "https://example.com/watch?v=1&t=855s",
+            "download_type": "video",
+            "codec": "auto",
+            "format": "any",
+            "quality": "best",
+        })
+        self.assertEqual(parsed["url"], "https://example.com/watch?v=1&t=855s")
+        self.assertIsNone(parsed["clip_start"])
+        self.assertIsNone(parsed["clip_end"])
+
+    def test_extract_t_query_youtu_be_short_host(self):
+        cleaned, start = main._extract_t_query_from_url("https://youtu.be/abc123?t=90")
+        self.assertEqual(cleaned, "https://youtu.be/abc123")
+        self.assertEqual(start, 90.0)
+
     def test_clip_rejects_end_before_start(self):
         with self.assertRaises(main.web.HTTPBadRequest):
             main.parse_download_options({
@@ -280,5 +299,17 @@ class ParseDownloadOptionsTests(unittest.TestCase):
             })
 
 
+class GetCustomDirsTests(unittest.TestCase):
+    def test_works_without_a_running_event_loop(self):
+        # get_custom_dirs() used to time its cache via
+        # asyncio.get_running_loop().time(), which raises RuntimeError outside
+        # a running loop (e.g. when called from a plain executor thread). It
+        # must work from a synchronous context too.
+        result = main.get_custom_dirs()
+        self.assertIn("download_dir", result)
+        self.assertIn("audio_download_dir", result)
+        self.assertIn("", result["download_dir"])
+
+
 if __name__ == "__main__":
     unittest.main()