fix: address review bugs in server implementation

- Fix keyframe 6-tuple → 4-tuple mismatch crashing ExportRunner
- Fix ws.broadcast() using wrong event loop from background threads
- Fix export counter hardcoded to 1, now auto-increments
- Add path traversal protection to file/stream/delete endpoints
- Use proper HTTP error codes (was returning 200 for errors)
- Add thread safety to WebSocket connection list
- Record exports to DB so markers appear
- Move WS endpoint to /ws/export (was /api/ws/export)
- Prune dead threads from cache job tracker

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/app.py

@@ -1,8 +1,9 @@
-from fastapi import FastAPI
+from fastapi import FastAPI, WebSocket
 
 from core.db import ProcessedDB
 from .config import DB_PATH
 from .routes import files, stream, markers, export, hidden
+from . import ws
 
 app = FastAPI(title="8-cut Server")
 
@@ -13,3 +14,8 @@ app.include_router(stream.router, prefix="/api")
 app.include_router(markers.router, prefix="/api")
 app.include_router(export.router, prefix="/api")
 app.include_router(hidden.router, prefix="/api")
+
+
+@app.websocket("/ws/export")
+async def export_ws(websocket: WebSocket):
+    await ws.connect(websocket)