chore(downloads): C3-C6 — DRY the source-URL, filename, and serialize helpers

- C3: `_reference_url` (downloads.py) and public.py's inline source-URL block were
  the same rule → extract `service.reference_url(job, asset)`; both surfaces now
  share it so the "downloaded from" link can't drift between them.
- C4: Content-Disposition filename derivation (ext pick + doubled-ext strip + join)
  was duplicated in download_file and watch_file → extract
  `storage.download_filename(display_name, container, path)`.
- C5: inline the one-line `_clean_basename` passthrough (folded into C4).
- C6: the `db.get(MediaAsset, job.asset_id) if job.asset_id else None; _serialize(...)`
  resolve-then-serialize dance was repeated across 6 single-job handlers → fold into
  `_serialize_job(db, job)`. (File-serving handlers that use the asset for their own
  checks keep their explicit resolve.)

Behavior-neutral; ruff/parse clean, localdev boots, downloads routes load.

backend/app/downloads/links.py

@@ -75,13 +75,7 @@ def public_meta(link: DownloadLink, job, asset, file_url: str, poster_url: str |
     auto-extracted values, and surfaces the source + any extra reference links as clickable URLs."""
     from app.downloads import service
 
-    source_url = None
-    if job is not None and job.job_kind != "edit":
-        source_url = asset.source_webpage_url or (
-            service.source_url(job.source_kind, job.source_ref)
-            if job.source_kind in ("youtube", "url")
-            else None
-        )
+    source_url = service.reference_url(job, asset)
     return {
         "title": (job and job.display_name) or asset.title,
         "uploader": (job and job.display_uploader) or asset.uploader,