refactor: four small cleanups from the review pass (#3072)

Items 2-5 of #3072. Item 1 (the per-row sweep inserts) is separate.

2. .fc-bad was not merely duplicated — it is .fc-weak under a second
   name. Both local definitions were `color: rgb(var(--v-theme-error))`,
   identical to the global .fc-weak, and GpuAgentCard was already using
   .fc-weak to colour exactly what GpuActivityPanel coloured .fc-bad (an
   errored count, red when non-zero). So rather than promoting a synonym
   to app.css, both call sites now use .fc-weak and the local defs are
   gone. app.css's status-colour comment records why there is no .fc-bad,
   next to the existing note on why .fc-ok is deliberately NOT global.

3. GalleryItem.vue's obsidian literals now use --v-theme-background,
   which IS obsidian (vuetify-theme.js maps background -> surfaces.
   obsidian). Preferred over --fc-chrome-rgb: same value, but that
   variable is named for the nav fade, not for the palette entry.

   The ticket said these were the only three real uses in the tree. They
   are not — GalleryItem itself had two more in the artist-label
   gradient (fixed here, so the file is now consistent), and ~13 more
   live in SeriesView, SeriesReaderView, ImageViewer, ArtistHeader,
   ExploreView and GalleryFilterBar. Those are a separate sweep, filed
   rather than folded in here.

4. The attachment download path had two hand-formatted copies. One
   definition now, `attachment_download_url`, next to the model both
   serializers already import. The test pins it by MATCHING the built
   path against the app's real URL map rather than comparing to a
   literal — a string-equality test would still pass after someone
   renamed the route, which is the drift the helper exists to prevent.

5. Extension API key now compares with hmac.compare_digest. Compared as
   BYTES, not str: compare_digest's str form raises TypeError on
   non-ASCII, and this value comes straight from an attacker-controlled
   header, so the str form would turn a junk key into a 500 instead of a
   403. Low stakes either way — the API is unauthenticated-by-design on
   a LAN — but it costs nothing.

Refs #3072

frontend/src/components/gallery/GalleryItem.vue

@@ -139,9 +139,9 @@ function onThumbError() { thumbError.value = true }
   position: absolute; top: 8px; left: 8px;
   width: 22px; height: 22px; border-radius: 4px;
   border: 2px solid rgba(232, 228, 216, 0.8);
-  background: rgba(20, 23, 26, 0.45);
+  background: rgba(var(--v-theme-background), 0.45);
   display: grid; place-items: center;
-  color: #14171A; z-index: 11;
+  color: rgb(var(--v-theme-background)); z-index: 11;
 }
 .fc-gallery-item__checkbox.on {
   background: rgb(var(--v-theme-accent));
@@ -152,7 +152,7 @@ function onThumbError() { thumbError.value = true }
   min-width: 22px; height: 22px; padding: 0 5px;
   border-radius: 11px;
   background: rgb(var(--v-theme-accent));
-  color: #14171A; font-size: 12px; font-weight: 700;
+  color: rgb(var(--v-theme-background)); font-size: 12px; font-weight: 700;
   display: grid; place-items: center; z-index: 11;
   pointer-events: none;
 }
@@ -160,7 +160,8 @@ function onThumbError() { thumbError.value = true }
   position: absolute; left: 0; right: 0; bottom: 0;
   padding: 14px 8px 6px;
   background: linear-gradient(
-    to top, rgba(20, 23, 26, 0.78), rgba(20, 23, 26, 0)
+    to top, rgba(var(--v-theme-background), 0.78),
+    rgba(var(--v-theme-background), 0)
   );
   font-size: 12px; line-height: 1.2;
   white-space: nowrap; overflow: hidden; text-overflow: ellipsis;

frontend/src/components/settings/DownloadsActivityPanel.vue

@@ -35,7 +35,7 @@
         All subscription sources healthy.
       </p>
       <p v-else class="text-body-2 mb-0">
-        <b class="fc-bad">{{ failing.length }}</b> failing source(s):
+        <b class="fc-weak">{{ failing.length }}</b> failing source(s):
         <span class="fc-muted">{{ failingNames }}</span>
       </p>
     </v-card-text>
@@ -72,5 +72,4 @@ onUnmounted(() => { if (pollId) clearInterval(pollId) })
 </script>
 
 <style scoped>
-.fc-bad { color: rgb(var(--v-theme-error)); }
 </style>

frontend/src/components/settings/GpuActivityPanel.vue

@@ -25,7 +25,7 @@
           <div class="fc-cell__l">done</div>
         </div>
         <div class="fc-cell">
-          <div class="fc-cell__n" :class="q.error ? 'fc-bad' : ''">{{ q.error }}</div>
+          <div class="fc-cell__n" :class="q.error ? 'fc-weak' : ''">{{ q.error }}</div>
           <div class="fc-cell__l">errored</div>
         </div>
       </div>
@@ -104,5 +104,4 @@ onUnmounted(() => { if (pollId) clearInterval(pollId) })
   font-size: 11px; text-transform: uppercase; letter-spacing: 0.04em;
   color: rgb(var(--v-theme-on-surface-variant));
 }
-.fc-bad { color: rgb(var(--v-theme-error)); }
 </style>

frontend/src/styles/app.css

@@ -50,7 +50,12 @@
 
 /* Status text colours (DRY pass #161): fc-good = success, fc-weak = error,
    consolidated from the GPU / heads cards. fc-ok is intentionally NOT global —
-   it means on-surface in HeadsCard but success in QueuesTable. */
+   it means on-surface in HeadsCard but success in QueuesTable.
+
+   No `.fc-bad` (#3072): it was defined locally and identically in the Downloads
+   and GPU activity panels, and it is fc-weak under a second name — GpuAgentCard
+   and GpuActivityPanel were colouring the same "errored" count with different
+   class names. Both now use fc-weak. Reach for fc-weak, not a new synonym. */
 .fc-good { color: rgb(var(--v-theme-success)); }
 .fc-weak { color: rgb(var(--v-theme-error)); }