fix: harden media server — temp-file yt-dlp stderr, parse guards, UI failure surfacing

- yt-dlp stderr now goes to a temp file so a chatty stderr can never
  deadlock the stdout progress loop.
- report/search/seek numeric parsing returns 400 instead of 500.
- now-playing card reflects failed/preparing download states.
- media runtime data (library.json, jobs/) is gitignored; only
  .gitkeep is tracked.

web/media_server.py

@@ -29,6 +29,7 @@ import os
 import re
 import subprocess
 import sys
+import tempfile
 import threading
 import time
 import uuid
@@ -259,13 +260,16 @@ def _download_worker(job: dict, track: dict, video_id: str) -> None:
     ]
     job["stage"] = "downloading"
     info: dict = {}
+    # stderr goes to a temp file: reading it from a PIPE while the stdout
+    # loop blocks could deadlock if yt-dlp ever fills the stderr buffer.
+    with tempfile.TemporaryFile(mode="w+", encoding="utf-8", errors="replace") as errfile:
         try:
             proc = subprocess.Popen(
-            cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                cmd, stdout=subprocess.PIPE, stderr=errfile,
                 text=True, errors="replace",
             )
             deadline = time.monotonic() + DOWNLOAD_TIMEOUT
-        assert proc.stdout is not None and proc.stderr is not None
+            assert proc.stdout is not None
             for line in proc.stdout:
                 if time.monotonic() > deadline:
                     proc.kill()
@@ -287,7 +291,8 @@ def _download_worker(job: dict, track: dict, video_id: str) -> None:
                         pass
             proc.wait(timeout=30)
             if proc.returncode != 0:
-            stderr_tail = (proc.stderr.read() or "").strip().splitlines()
+                errfile.seek(0)
+                stderr_tail = (errfile.read() or "").strip().splitlines()
                 detail = stderr_tail[-1] if stderr_tail else f"exit code {proc.returncode}"
                 raise RuntimeError(detail)
             if not target.exists():
@@ -548,12 +553,16 @@ async def report(request: Request) -> dict:
     """The browser reports real playback state (source of truth for the player)."""
     body = await request.json()
     room = str(body.get("room") or "default")
+    try:
+        position = float(body.get("position") or 0.0)
+    except (TypeError, ValueError):
+        position = 0.0
     with _lock:
         st = _room_state(room)
         st["reported"] = {
             "track_id": body.get("track_id"),
             "state": str(body.get("state") or "stopped"),
-            "position": float(body.get("position") or 0.0),
+            "position": position,
             "duration": body.get("duration"),
             "ts": time.time(),
         }