fix(trickplay): stop scan-time sprite generation from saturating the host

Trickplay sprite generation (one full-decode ffmpeg pass per file) could pin a
machine: multiple agents on the same library decoded the same 4K file at once, no
CPU throttling, and crashed/restarted agents orphaned ffmpeg to init (it ran the
full 45-min decode to completion). Stacked orphans spiked a box to load ~140.

- Single-flight lock: O_CREATE|O_EXCL .lock in the shared sidecar dir so two
  agents watching the same library never decode the same file twice (stale locks
  reclaimed after a TTL). Returns ErrTrickplayInProgress → prewarm skips, not fail.
- Load gate: defer the heavy decode until 1-min load ≤ max(ratio×NumCPU, 1.5),
  capped at 15 min so it throttles without ever becoming a permanent off-switch on
  busy / small hosts. New knob library.prewarm_max_load_ratio (default 0.7).
- Concurrency: trickSem caps trickplay to ONE decode at a time per agent.
- CPU priority: setLowCPUPriority (nice 19) alongside the existing idle ionice.
- No orphans: hardenCmd sets Setpgid + Pdeathsig=SIGKILL, with runtime.LockOSThread
  around the child so the kernel kills ffmpeg exactly when the agent dies (and not
  spuriously — golang/go#27505).

Tests: single-flight/stale-reclaim, load-gate immediate/cancel, and an e2e
Pdeathsig orphan-kill check.

internal/library/loadgate_test.go

@@ -0,0 +1,46 @@
+package library
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/torrentclaw/unarr/internal/library/mediainfo"
+)
+
+// A huge ratio means the threshold is always above the real load, so the gate
+// must return immediately (no blocking) regardless of how busy the box is.
+func TestWaitForLowLoad_HighRatioReturnsImmediately(t *testing.T) {
+	done := make(chan struct{})
+	go func() {
+		waitForLowLoad(context.Background(), 1e9)
+		close(done)
+	}()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("waitForLowLoad blocked despite an impossibly-high threshold")
+	}
+}
+
+// With a tiny ratio the gate would block (load almost always exceeds it), but a
+// cancelled context must unblock it promptly — the prewarm has to stop cleanly on
+// Ctrl-C / daemon shutdown even while waiting for the machine to go idle.
+func TestWaitForLowLoad_RespectsContextCancel(t *testing.T) {
+	if _, ok := mediainfo.LoadAverage1(); !ok {
+		t.Skip("no load reading on this platform — gate is a no-op")
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // already cancelled
+
+	done := make(chan struct{})
+	go func() {
+		waitForLowLoad(ctx, 0.0001) // threshold ~0 → would otherwise block
+		close(done)
+	}()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("waitForLowLoad ignored a cancelled context")
+	}
+}