feat(twitch): coordinate persistent upstream leases

[Serph91P]

Summary

• add durable Twitch upstream leases and a database-backed coordinator with channel, authenticated-account, and total-budget arbitration
• fence Recording, Live, rotation, recovery, stop, cancellation, and cleanup by lease generation and exact process identity
• add migration 040, configurable total upstream capacity, anonymous-default Live, machine-readable conflicts, and persisted Live-owner checks

Closes #783

Threat model

This changes user-controlled process starts, credentials, authorization, process-group ownership, recovery fencing, persistent state, and denial-of-service limits. The implementation stores no command line, OAuth value, proxy credential, signed URL, header, or playback token in a lease. Live stops require the stored LIVE owner, generation, and process identity. Reused PIDs and stale generations are rejected.

Rollout

Migration 040 is additive. New starts reserve durable leases before child creation. Existing recordings are not restarted or terminated during deployment. Reconciliation releases only expired leases whose exact process identity is no longer live.

Rollback

Do not downgrade while active lease rows exist. Drain or reconcile leases first. Migration 040 rejects a downgrade while STARTING, ACTIVE, ROTATING, or RECOVERING rows are present.

RED/GREEN evidence

• RED on 336ac0024e8280ce087c7b3de52c02ffc37fdcf5: the new Live activation-failure regression observed activation without start time/fingerprint, and the Recording regression observed the assumed PID as PGID with no complete identity; each failed before production edits.
• GREEN on baa1fe6e21fb426fc500a47eb566084372381fa6: both activation-failure regressions pass and require exact child reaping before the real SQLite-backed durable release.
• The eight prior process-identity/rotation remediation regressions pass unchanged.

Verification

• focused activation-failure regressions: 2 passed
• affected Live and Recording suites: 44 passed
• eight prior remediation regressions: 8 passed
• full backend: 254 passed, 2 skipped
• ruff check app/ and ruff format --check app/
• Ruff check and format check for all four changed Python files
• python -m app.migrations_init
• npm ci, npm run lint, npm run lint:tokens, npm run type-check, npm run build
• local no-push Docker build: streamvault:issue-783-local
• npm audit, pip-audit, Safety, Bandit, Hadolint, Trivy image scan, and Gitleaks exact-commit scan
• staged and unstaged git diff --check; tracked changed-file Unicode dash scan