feat(playback): pre-transcode HEVC videos in background; veryfast preset

Long videos blocked /playback for the entire encode duration. The fix
is to populate the cache before the user clicks, not when they click.

Changes:
- Extract ffprobe + ffmpeg helpers to services/video.py so the request
  handler and the background task share one sync implementation. The
  endpoint wraps calls in asyncio.to_thread; celery just calls them.
- New tasks/video.py with pretranscode_video. Idempotent: skips when
  the cache is already current and skips passthrough-safe sources
  (h264 in mp4/m4v/webm). 30-min task time limit so the long-tail
  files (3GP archive, multi-minute 1080p clips) still complete.
- scan_folder now dispatches pretranscode_video alongside
  generate_thumbnails / extract_metadata for any new video row.
- POST /library/maintenance/backfill-video-cache enqueues every
  active video so the existing library catches up.
- libx264 preset bumped from fast to veryfast. ~2x throughput on this
  CPU-only box, output a few % larger but well within disk budget.
- /playback simplifies to: cache check, passthrough if h264 in
  web-safe container, else sync transcode (still there as fallback
  for races against the queued task).

Once the backfill task drains, /playback should be near-instant for
every video. Any video added afterwards is pre-transcoded at scan
time, so the user keeps that property going forward.

backend/app/services/video.py

@@ -0,0 +1,132 @@
+"""Shared video helpers used by the /playback endpoint and the
+pretranscode celery task.
+
+The actual ffmpeg/ffprobe work is sync (subprocess.run); FastAPI
+handlers wrap calls in asyncio.to_thread, celery just calls them
+directly. Keeping a single sync implementation avoids drift between
+the request-time fallback and the background pre-transcode."""
+from __future__ import annotations
+
+import logging
+import os
+import subprocess
+from pathlib import Path
+from typing import Optional
+
+
+logger = logging.getLogger(__name__)
+
+
+# On-disk cache of browser-playable transcodes. Backed by /data which is
+# the persistent volume in mulita-backend / mulita-worker-light.
+VIDEO_CACHE_DIR = Path('/data/video-cache')
+VIDEO_CACHE_DIR.mkdir(parents=True, exist_ok=True)
+
+# Codecs the browser can play in <video> across Chrome / Firefox / Safari
+# without re-encoding. h264 covers everything practical we have on disk;
+# add av1 / vp9 here if the source library ever picks those up.
+PLAYBACK_OK_VCODECS = {'h264', 'avc1'}
+
+# Container extensions that we trust to passthrough when the codec is
+# OK. .mov is intentionally excluded — Chrome and Firefox refuse to
+# play even h264-in-mov reliably, so .mov always goes through the cache.
+PLAYBACK_OK_EXTS = {'.mp4', '.m4v', '.webm'}
+
+
+def cache_path_for(photo_id: str) -> Path:
+    """Where the transcoded MP4 lives for a given photo id."""
+    return VIDEO_CACHE_DIR / f'{photo_id}.mp4'
+
+
+def ffprobe_video_codec(path: str) -> Optional[str]:
+    """Return the video stream's codec_name (lowercased) or None on
+    probe failure. ~50ms for typical files."""
+    try:
+        result = subprocess.run(
+            [
+                'ffprobe', '-v', 'error',
+                '-select_streams', 'v:0',
+                '-show_entries', 'stream=codec_name',
+                '-of', 'default=noprint_wrappers=1:nokey=1',
+                path,
+            ],
+            capture_output=True, text=True, timeout=10,
+        )
+    except (subprocess.TimeoutExpired, OSError) as e:
+        logger.warning("ffprobe failed for %s: %s", path, e)
+        return None
+    if result.returncode != 0:
+        logger.warning(
+            "ffprobe rc=%s for %s: %s",
+            result.returncode, path, (result.stderr or '').strip()[:200],
+        )
+        return None
+    return ((result.stdout or '').strip().lower()) or None
+
+
+def needs_transcode(src_path: str) -> bool:
+    """True when /playback would have to encode rather than passthrough.
+    Uses extension first (cheap), only ffprobes when the container is
+    plausibly web-safe."""
+    ext = Path(src_path).suffix.lower()
+    if ext not in PLAYBACK_OK_EXTS:
+        return True
+    return ffprobe_video_codec(src_path) not in PLAYBACK_OK_VCODECS
+
+
+def transcode_to_h264_mp4(src: str, dst: str, *, timeout: int = 3600) -> bool:
+    """Transcode `src` to H.264 8-bit MP4 at `dst`. Returns True on
+    success.
+
+    -pix_fmt yuv420p forces 8-bit output so 10-bit HEVC sources still
+    play on browsers without 10-bit decode. Audio is always re-encoded
+    to AAC because iPhone 16 ships APAC audio that browsers can't
+    decode, and the audio pass is cheap next to the video pass.
+    +faststart relocates the moov atom so progressive playback works.
+
+    Atomic publish via tmp + os.replace so a failed run never leaves a
+    half-written .mp4 in the cache. -f mp4 forces the muxer because the
+    .tmp suffix isn't a format hint ffmpeg recognises."""
+    tmp = dst + '.tmp'
+    try:
+        result = subprocess.run(
+            [
+                'ffmpeg', '-y', '-loglevel', 'error',
+                '-i', src,
+                '-map', '0:v:0',
+                '-map', '0:a:0?',
+                '-c:v', 'libx264',
+                '-preset', 'veryfast',
+                '-crf', '23',
+                '-pix_fmt', 'yuv420p',
+                '-c:a', 'aac',
+                '-b:a', '160k',
+                '-movflags', '+faststart',
+                '-f', 'mp4',
+                tmp,
+            ],
+            capture_output=True, text=True, timeout=timeout,
+        )
+    except (subprocess.TimeoutExpired, OSError) as e:
+        logger.error("ffmpeg failed for %s: %s", src, e)
+        try:
+            os.remove(tmp)
+        except OSError:
+            pass
+        return False
+    if result.returncode != 0:
+        logger.error(
+            "ffmpeg rc=%s for %s: %s",
+            result.returncode, src, (result.stderr or '').strip()[:500],
+        )
+        try:
+            os.remove(tmp)
+        except OSError:
+            pass
+        return False
+    try:
+        os.replace(tmp, dst)
+    except OSError as e:
+        logger.error("failed to publish transcoded %s: %s", dst, e)
+        return False
+    return True