feat(downloader): validate and quarantine truncated files post-download

After gallery-dl returns, parse stdout for written file paths and run
the magic-byte validator on each. Files that fail are moved to
{download_path}/_quarantine/{subscription}/{platform}/ with a sidecar
JSON capturing the source URL, validation reason, and original path —
enough for an operator to redownload-from-source or delete.

Adds ErrorType.VALIDATION_FAILED. A successful gallery-dl run that
produced quarantined files is now a soft failure (success=False,
error_message names the dominant failure reason and count) so the
source's error_count ticks up and the dashboard surfaces it. Gated
by download.validate_files setting (default True).

files_quarantined and quarantined_paths are persisted into download
metadata for the UI/API to consume.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/app/models/setting.py

@@ -41,6 +41,7 @@ DEFAULT_SETTINGS = {
     "download.rate_limit": 3.0,
     "download.retry_count": 3,
     "download.schedule_interval": 28800,  # 8 hours
+    "download.validate_files": True,
     "notification.enabled": False,
     "notification.webhook_url": None,
     "dashboard.failure_threshold": 5,
@@ -51,3 +52,6 @@ EXTENSION_API_KEY_SETTING = "security.extension_api_key"
 
 # Key for cached storage stats
 STORAGE_STATS_SETTING = "cache.storage_stats"
+
+# Key for cached library-validation report (last sweep)
+LIBRARY_VALIDATION_REPORT_SETTING = "cache.library_validation_report"