Files: a sweep of the edges

Found by walking every handler and the UI with odd inputs, then a battery of requests
against the live hub. Fixed:
- A save over the 8 MiB cap was cut short in place: the file was truncated, then the
  first 8 MiB written, and the caller told 204. Now the body is read whole first and a
  body over the cap is a 413 with the file untouched.
- A link to a file showed the link's own time; now the file's, so the row reads right
  and the preview key follows the file.
- Reading a link to nothing answered 200 with an empty body (the open failed after the
  headers in root mode); now a 404 that names the target.
- A play request with an unknown codec or size was answered by inspecting the file
  first, so an audio-only file said "no video stream" instead of what was wrong; the
  choice is checked before any work, and is a 400.
- A stream that ended in failure was handed back to the next identical request for ten
  minutes; a failed one is now dropped and a fresh one made.
- A player that left while its stream was still finding a first segment made the loop
  try the next recipe; it stops. A stream closed mid-start is not started again.
- Ending a root-mode ffmpeg could wait forever: the daemon cannot signal root's
  processes, so the wait is bounded and the helper's own grace does the rest.
- A page going away (a phone closing the tab) releases its stream by a beacon, rather
  than ten minutes later by the sweeper.
- The path box resolves like a shell — relative to the folder shown, . and .. applied,
  trailing slashes dropped — in the tab and in the Move picker, with a test. A typed path
  that is a file opens it; a remembered folder that is gone falls back to / once.
- A dropped folder arrived as a nameless empty file; it is refused with a word. The
  upload toast counts what was actually uploaded.
- The viewer names a device, pipe or socket, and a dangling link, instead of calling
  them binary files.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/media/hls.go

@@ -47,6 +47,7 @@ type Stream struct {
 	proc     *ffproc
 	finished bool
 	failure  string
+	gone     bool // forgotten by the Streamer
 }
 
 // StreamStatus is what the player asks for while the file is still going through.
@@ -93,20 +94,25 @@ func (m *Streamer) Open(ctx context.Context, c Caps, root bool, path, codec, qua
 	if c.Error != "" {
 		return nil, errors.New(c.Error)
 	}
+	if err := ValidChoice(codec, quality); err != nil {
+		return nil, err
+	}
+	q, _ := qualityByID(quality)
 	if src.Video == nil {
 		return nil, &DecodeError{Msg: "no video stream"}
 	}
-	q, ok := qualityByID(quality)
-	if !ok {
-		return nil, errors.New("unknown quality " + quality)
-	}
-	if !codecKnown(codec) {
-		return nil, errors.New("unknown codec " + codec)
+	if src.Video.Width <= 0 || src.Video.Height <= 0 {
+		return nil, &DecodeError{Msg: "the picture's size is unknown"}
 	}
 	key := fmt.Sprintf("%s|%d|%.0f|%s|%s|%v", path, src.Size, src.Duration, codec, quality, root)
 	m.mu.Lock()
 	for _, s := range m.streams {
 		if s.key == key {
+			if s.failed() { // not the stream to hand back: let it go and make a fresh one
+				delete(m.streams, s.ID)
+				_ = os.RemoveAll(s.dir)
+				break
+			}
 			m.mu.Unlock()
 			s.touch()
 			return s, nil
@@ -152,15 +158,19 @@ func (m *Streamer) Open(ctx context.Context, c Caps, root bool, path, codec, qua
 		s.mu.Lock()
 		s.proc, s.Engine = p, r.Engine
 		s.mu.Unlock()
-		if msg, ok := s.waitFirstSegment(ctx); ok {
+		msg, ok := s.waitFirstSegment(ctx)
+		if ok {
 			go s.watch()
 			log.Printf("media: stream %s: %s → %s %s %dx%d %dk on %s", s.ID, filepath.Base(path), codec, quality, s.Width, s.Height, s.Kbps, r.Engine)
 			return s, nil
-		} else {
-			last = r.Engine + ": " + msg
-			log.Printf("media: stream %s on %s: %s", filepath.Base(path), r.Engine, msg)
 		}
 		p.end()
+		if ctx.Err() != nil || s.closed() { // the caller left, or somebody closed it meanwhile: not the recipe's fault
+			m.forget(s)
+			return nil, errors.New("cancelled")
+		}
+		last = r.Engine + ": " + msg
+		log.Printf("media: stream %s on %s: %s", filepath.Base(path), r.Engine, msg)
 	}
 	m.forget(s)
 	return nil, &DecodeError{Msg: last}
@@ -240,9 +250,20 @@ func (m *Streamer) forget(s *Stream) {
 	m.mu.Lock()
 	delete(m.streams, s.ID)
 	m.mu.Unlock()
+	s.mu.Lock()
+	s.gone = true
+	s.mu.Unlock()
 	_ = os.RemoveAll(s.dir)
 }
 
+func (s *Stream) closed() bool { s.mu.Lock(); defer s.mu.Unlock(); return s.gone }
+
+func (s *Stream) failed() bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.finished && s.failure != ""
+}
+
 // Sweep closes what nobody has touched for a while.
 func (m *Streamer) Sweep(idle time.Duration) {
 	m.mu.Lock()