feat(import-resilience L2): one-shot re-download for corrupt downloaded files

Layer 2 — remediate a corrupt file by re-fetching a fresh copy from its
source, bounded to a single attempt. Operator-requested 2026-05-28.

New backend/app/services/refetch_service.py:
- resolve_refetch_source: parse the failed file's sidecar → platform,
  derive the artist from the import path, find an ENABLED Source with a
  real feed URL for (artist, platform). Returns None for filesystem-only
  imports, missing sidecars, or `sidecar:<platform>:<slug>` synthetic
  anchors (not pollable).
- attempt_refetch: if not already refetched AND a Source resolves,
  delete the corrupt file (so gallery-dl's skip_existing re-fetches it),
  set ImportTask.refetched=True, and trigger ONE download_source
  re-check. Bounded by `refetched` so source-side corruption can't loop.

Wiring:
- Manual endpoint POST /api/import/tasks/<id>/refetch (only on 'failed'
  tasks). Returns refetch_queued / no_source / already_refetched /
  not_found / not_failed.
- Auto path in recover_interrupted_tasks: for each poison-pill row, if
  env FC_AUTO_REFETCH_CORRUPT=1, attempt_refetch (default OFF — the
  manual button is the primary path; auto is opt-in since re-fetch
  deletes a file + re-runs the downloader).
- Frontend: a cloud-refresh icon button on failed rows in ImportTaskList
  → stores.import.refetchTask → toast keyed on the result status.

Filesystem imports with no upstream return no_source — the operator's
only remediation there is replacing the file on disk, surfaced clearly
in the toast.

Tests: 404 unknown task, 400 non-failed task, no_source when
unresolvable, and the full resolvable-source path (file deleted,
refetched flag set, one download_source dispatched, second call is a
no-op). The resolvable test repoints the migration-seeded
import_settings(id=1) scan path rather than inserting a conflicting row.

frontend/src/stores/import.js

@@ -146,6 +146,15 @@ export const useImportStore = defineStore('import', () => {
     return body
   }
 
+  // Layer-2 one-shot re-download for a failed task's (corrupt) file.
+  // Returns the endpoint's status dict (refetch_queued / no_source /
+  // already_refetched). Caller surfaces it as a toast.
+  async function refetchTask(taskId) {
+    const body = await api.post(`/api/import/tasks/${taskId}/refetch`)
+    await loadTasks(true)
+    return body
+  }
+
   const hasMore = computed(() => tasksNextCursor.value !== null)
 
   return {
@@ -155,6 +164,7 @@ export const useImportStore = defineStore('import', () => {
     triggerError,
     loadSettings, patchSettings,
     refreshStatus, triggerScan,
-    loadTasks, setStatusFilter, retryFailed, clearCompleted, clearStuck
+    loadTasks, setStatusFilter, retryFailed, clearCompleted, clearStuck,
+    refetchTask,
   }
 })