Backend robustness: streaming, OOM guards, WS fixes, caches, write locks

[ljchang]

Summary

The backend robustness batch from the July review backlog — 12 commits, each task individually reviewed, plus a final whole-branch review whose findings are fixed in the last two commits.

Memory & performance

• Range requests stream in 1 MiB chunks — Viewer playback no longer buffers entire recordings into RAM (browsers request bytes=0-); inverted ranges now 416 instead of returning corrupt framing
• 4K analyze OOM guard: detect batches are clamped to a pixel budget (8×720p equivalent) — a 4K source now batches 1 frame instead of allocating ~1.5 GB of transient tensors
• Detector reuse across same-config queue items (multi-second model load previously paid per item; documented two-resident-detectors tradeoff)
• Analyze uploads copy off the event loop — queueing a multi-GB video no longer freezes Live streaming
• mtime-keyed caches for thumbnail bbox lookups (was k full CSV parses for k identities) and frame-times (was a full demux per request), nanosecond-keyed
• clip_start seeks instead of decoding-and-discarding everything before it; frame counts estimated from duration×rate instead of a full decode pass

Correctness

• VFR frame indexing (caught by the final whole-branch review): the seek rewrite initially derived source indices as round(pts·fps), which corrupts fex frame values for variable-rate sources — including this app's own Live recordings (wall-clock PTS). Fixed: positional indexing when not seeking (the pre-existing contract, byte-for-byte), presentation-order PTS rank when seeking. Verified against genuine B-frame reorder and VFR+seek beyond the committed regression tests.
• Fractional-fps clip boundaries (23.976 etc.) no longer admit a frame early / phase-shift the skip stride
• Analyze WebSocket now observes client disconnects (subscriber queues no longer leak per reconnect) and never drops terminal done/failed events on overflow (evict-oldest)
• Per-session write locks + unique temp files: concurrent click-to-label calls no longer lose updates (pre-lock evidence: 18 of 24 concurrent assignments lost, 3/3 runs; all 24 land with the lock)

Test plan

• Full suite: 233 passed (11 new tests incl. VFR/fractional-fps regressions with recorded pre-fix failures, WS overflow, cache hits, the 24-thread race test)
• Whole-branch review verdict: Ready to merge (B-frame reorder + VFR-seek verified empirically)