feat(downloads): M1 — schema, config, worker container, deps

- models: MediaAsset (shared file cache, unique on source+format_sig), DownloadJob
  (per-user request), DownloadProfile (presets), DownloadShare (ACL), DownloadQuota
- migrations 0036 (5 tables) + 0037 (6 builtin presets)
- sysconfig 'downloads' group (per-user defaults, retention/GC, layout, worker concurrency)
- config: DOWNLOAD_ROOT / WORKER_ENABLED env + download defaults
- deps: yt-dlp in requirements, ffmpeg in Dockerfile runtime stage
- worker: dedicated container (python -m app.worker), thin idle entry (loop lands in M2)
- localdev compose: worker service + downloads bind-mount; gitignore downloads/

backend/requirements.txt

@@ -13,3 +13,7 @@ py3langid>=0.3,<1.0
 itsdangerous>=2.1,<3.0
 cryptography>=46.0.7,<47
 argon2-cffi>=23.1,<26
+# Download center: yt-dlp does the extraction/download; ffmpeg (installed at the OS level in
+# the Dockerfile) does the merge + postprocessing. yt-dlp is release-often (YouTube changes),
+# so keep the floor loose and bump it when extraction breaks.
+yt-dlp>=2025.1