feat: show live download speed and progress

[guoshulin1992-prog]

Summary

• Stream yt-dlp output while a download is running instead of waiting for the subprocess to finish.
• Expose structured current-stream progress, downloaded bytes, total bytes, speed, and ETA through the job status API.
• Show honest download, finalizing, processing, complete, and failed states in the web UI.
• Add bounded subprocess lifecycle handling so silent, stalled, or very noisy child processes do not block the worker indefinitely.

Details

• Uses yt-dlp --progress-template with a private line prefix and JSON payload rather than parsing human-readable progress text.
• Keeps unknown totals unknown and marks estimated totals separately; a later real total takes precedence.
• Treats each video/audio stream as its own current-stream progress and clears speed/ETA when the stream is finished.
• Shows an indeterminate bar when no trustworthy percentage exists and hides stale speed/ETA values after the progress update becomes old.
• Uses a single polling loop per card with a request timeout and generation guard, preventing overlapping polls and late responses from overwriting a retry.
• Keeps subprocess invocation shell-free and preserves the URL safety behavior from PR Fix: prevent yt-dlp argument injection via unsanitized URL (RCE) #58, including the -- URL separator.
• Keeps the Docker service bound to the local host in the supplied Compose configuration.

Tests

Executed locally on 2026-09-02:

• 21 Python unit/integration tests passed with -W error::ResourceWarning.
• 3 Node.js frontend tests passed.
• py_compile passed for app.py, progress.py, and download_process.py.
• git diff --check passed.
• Both structured --progress-template arguments were accepted by the installed yt-dlp (2026.08.19).
• Docker image build succeeded; an isolated container served the UI on a loopback-only test port.
• Local browser smoke test with a user-authorized Bilibili video showed changing percentage, current-stream size, speed, and ETA, and the download completed successfully.

Relationship to existing work

• Related to PR fix: handle large file downloads with progress tracking (fixes #2) #13, which already explores basic percentage/progress tracking. This change extends that direction with speed, ETA, byte counts, current-stream semantics, post-processing states, bounded output handling, and regression tests.
• The branch also contains the security change from PR Fix: prevent yt-dlp argument injection via unsanitized URL (RCE) #58 as local integration base because that PR is still open. If maintainers prefer independent review, rebase this branch after Fix: prevent yt-dlp argument injection via unsanitized URL (RCE) #58 lands or split/drop the duplicate security commit before merging.
• This PR intentionally does not use Closes #2; that issue is not the correct issue for this download-progress work.

Known limitations

• Platform/site behavior still depends on the current yt-dlp extractor and the target site's access rules.
• Full automated browser E2E coverage and a broad matrix of media sites are not included in this first contribution.
• The PR does not change authentication, cookies, or public exposure policy; local deployments should continue to bind to 127.0.0.1 unless the operator deliberately chooses otherwise.