fix: second-pass review bugs in server and core

- ExportRunner: stop batch on first error (was continuing, overwriting
  error status with done)
- Export route: validate input_path against MEDIA_DIRS
- Export route: validate encoder, portrait_ratio, folder_suffix, name
- Export route: fix format check for WebP sequence
- Export route: add _ separator in folder_suffix (match GUI)
- Export route: use realpath consistently in delete endpoint
- Export route: drop runner ref on completion (prevent memory leak)
- ProcessedDB: use cursor-level row_factory (thread-safe)
- WebSocket: catch all exceptions in connect, cleanup in finally
- Dockerfile: use uvicorn[standard] for websockets support

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/db.py

@@ -121,14 +121,14 @@ class ProcessedDB:
         """Return config dict for an output_path, or None."""
         if not self._enabled:
             return None
-        self._con.row_factory = sqlite3.Row
-        row = self._con.execute(
+        cur = self._con.cursor()
+        cur.row_factory = sqlite3.Row
+        row = cur.execute(
             "SELECT label, category, short_side, portrait_ratio, crop_center, format,"
             " clip_count, spread"
             " FROM processed WHERE output_path = ?",
             (output_path,),
         ).fetchone()
-        self._con.row_factory = None
         return dict(row) if row else None
 
     def delete_by_output_path(self, output_path: str) -> None:

core/export.py

@@ -113,6 +113,7 @@ class ExportRunner:
                     except Exception as e:
                         if "cancelled" not in str(e) and self._on_error:
                             self._on_error(str(e))
+                        return
         except Exception as e:
             if self._on_error:
                 self._on_error(str(e))