feat(external): mega.nz via megatools in the runtime image (Phase 4c)

Use `megatools dl` (Debian-native apt package) for mega.nz public links rather
than MEGAcmd — no external MEGA apt repo/key to add, one apt line. Adds
`megatools` to the runtime Dockerfile; the fetcher's mega backend now shells
`megatools dl --path <dir> <url>` (key in the #fragment is preserved by the
extractor). gdown (gdrive) is already a pip dep in the runtime image.

NOTE: build.yml builds the image on main/tags only (not dev), so this Dockerfile
change is verified on the next dev→main merge, not by this dev push. The fetcher
code path is unit-tested via the mocked _run_mega_get seam.

With this, all 5 hosts download end-to-end once a celery download-worker runs.
Refs FC #830 (Phase 4c).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

requirements.txt

@@ -41,5 +41,5 @@ py7zr>=1,<2
 
 # Google Drive fetcher for off-platform file-host links (external downloads,
 # #830). Handles Drive's confirm-token + virus-scan interstitial. mega.nz uses
-# the MEGAcmd `mega-get` binary instead (added to the runtime image, not pip).
+# the `megatools` binary instead (Debian apt pkg in the runtime image, not pip).
 gdown>=5,<6