fix(audit-g1): six one-liner drift fixes from 2026-06-02 audit

- BACKFILL_TIMEOUT_SECONDS 1800→1170: keep the subprocess timeout
  30s below Celery's hard time_limit=1200 so SIGKILL doesn't beat
  TimeoutExpired (matched the tick 870s/900s rationale). Backfill
  runs that hit the cap let the next tick continue via the archive.

- recover_interrupted_tasks orphan UPDATE now stamps finished_at;
  without it cleanup_old_tasks' WHERE finished_at<cutoff never
  reaped orphan-swept rows. recover_stalled_task_runs also now sets
  duration_ms (matches celery_signals.finalize's millisecond math).

- ExtensionService.quick_add_source arms NEW_SOURCE_BACKFILL_RUNS=3
  on Source creation, mirroring SourceService.create. Without it,
  Firefox quick-add on a creator with >20 unsynced posts walked the
  full feed until subprocess timeout. Renamed the constant from
  _NEW_SOURCE_BACKFILL_RUNS so it can be imported cross-module.

- gallery_dl.verify() accepts TIER_LIMITED as auth-success alongside
  NO_NEW_CONTENT — the download path (line 712) already does, and
  TIER_LIMITED proves auth reached the post and was told it was
  tier-gated. Verify endpoint previously showed red on this and
  prompted operators to rotate working cookies.

- prune_unused_tags now runs a single DELETE with the NOT-IN
  predicate find_unused_tags uses, instead of SELECT-ids →
  DELETE-WHERE-IN. Removes the psycopg 65535-param cliff that
  would have surfaced on a tag explosion (>65k unused tags).

- credentials.upload() reflects the returned record into the store
  cache (`.set(platform, rec)`) instead of evicting it; previously
  the card briefly rendered "no credential" between upload and
  loadAll().

backend/app/services/source_service.py

@@ -90,7 +90,7 @@ _EDITABLE = {"enabled", "url", "config_overrides", "check_interval_override", "p
 # Plan #544 follow-up: newly created enabled sources pre-arm backfill so
 # their first N polls walk gallery-dl's full post history with the longer
 # timeout (matches the manual "Deep scan" button's default).
-_NEW_SOURCE_BACKFILL_RUNS = 3
+NEW_SOURCE_BACKFILL_RUNS = 3
 
 
 class SourceService:
@@ -218,7 +218,7 @@ class SourceService:
         # the budget is spent or the queue drains.
         # Disabled sources (incl. sidecar synthetics, url='sidecar:...')
         # are never polled, so leave their counter at 0.
-        backfill_runs = _NEW_SOURCE_BACKFILL_RUNS if enabled else 0
+        backfill_runs = NEW_SOURCE_BACKFILL_RUNS if enabled else 0
         source = Source(
             artist_id=artist_id, platform=platform, url=url,
             enabled=enabled, config_overrides=config_overrides,