fix: security hardening, memory leak, file cleanup, and UX improvements

[salmanrajz]

Security:

• Add URL validation (http/https only) on all endpoints
• Add format_id sanitization to prevent yt-dlp flag injection
• Add job_id format validation (hex, 10 chars)
• Add path traversal protection on file serving endpoint
• Add non-root user in Dockerfile
• Mask internal errors from API responses
• Add .env and .vscode/ to .gitignore

Stability:

• Add threading lock for jobs dict (race condition fix)
• Add job TTL auto-purge (1hr) to prevent memory exhaustion
• Add MAX_JOBS cap (500) with 503 response when full
• Add JSON parse error handling in /api/info
• Add explicit debug=False on Flask entry point

File management:

• Add /api/cleanup endpoint for client-triggered file removal
• Frontend calls cleanup 5s after save to free disk space
• Pin dependency versions in requirements.txt

UX/Frontend:

• Fix dlAll() to properly await each download via Promise-based polling
• Add ARIA labels on interactive elements
• Improve title sanitization (80 char limit, control char removal, no hidden files)

DevEx:

• Add structured logging throughout backend
• Add type hints on all functions
• reclip.sh now always runs pip install on venv reuse
• reclip.sh adds exit trap for clean shutdown message