feat(thumbnails): server-side video thumbnails via ffmpeg

Videos now get a thumbnail generated eagerly server-side on upload, through
the same WebP/blob-hash pipeline as photos — instead of the old browser path
that only ran when the Photos grid first rendered a video tile, re-downloaded
the whole video to seek a frame, and PUT 3 JPEGs back (and produced nothing at
all for HEVC/.mov, which a browser <video> cannot decode).

- New VideoFramePort (application) + FfmpegVideoFrameService / NoopVideoFrameService
  (infrastructure): shell out to the system ffmpeg (no compile-time libav dep),
  extract one representative frame as PNG, bounded by its own semaphore + a
  per-process timeout + kill_on_drop. Noop when ffmpeg is absent/disabled, so
  videos degrade gracefully to no thumbnail.
- ThumbnailRefreshHook.on_file_created routes video/* to
  generate_video_thumbnails_background: stream the (decrypted, reassembled) blob
  to a size- and time-bounded temp file on the data volume, extract a frame, and
  reuse the shared render_and_persist_all_webp helper — so video thumbnails are
  WebP, blob-hash keyed (dedup'd) and content-negotiated, exactly like photos.
- GET thumbnail serves the video's WebP to every client (byte-sniffed
  Content-Type); a genuine miss returns 204.
- Config: OXICLOUD_ENABLE_VIDEO_THUMBNAILS (default true, needs ffmpeg detected
  at startup) + OXICLOUD_FFMPEG_PATH / _CONCURRENCY / _TIMEOUT_SECS / _MAX_MB.
- Dockerfile installs ffmpeg in the runtime image.
- Frontend: drop the client-side generateVideoThumb/frameFromVideo re-download
  path; the server is now the source of truth.

Benchmark (examples/bench_video_thumbnails.rs, needs ffmpeg): 4/4 codecs incl.
HEVC/.mov produce a thumbnail server-side (was 0% for HEVC); ~50-70 ms/frame in
the background; ~3.9 KB preview WebP; up to ~23x less per-first-view transfer on
the test corpus (far more on real multi-MB clips). Methodology in
benches/VIDEO-THUMB.md.

Hardening from an adversarial review: video render holds the decode_semaphore
like the image path; the ffmpeg scale filter bounds both dimensions; the blob
stream has a timeout; the temp file lives on the data volume; the size cap uses
saturating_mul.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/common/config.rs

@@ -901,6 +901,11 @@ pub struct FeaturesConfig {
     /// Expose other OxiCloud users as a read-only "system" address book
     /// at GET /api/address-books. Set to false to hide the user directory.
     pub expose_system_users: bool,
+    /// Generate video thumbnails server-side via `ffmpeg` on upload. When true
+    /// (and ffmpeg is detected at startup) videos get a representative-frame
+    /// thumbnail through the same WebP pipeline as photos; otherwise videos have
+    /// no thumbnail. Env: `OXICLOUD_ENABLE_VIDEO_THUMBNAILS`.
+    pub enable_video_thumbnails: bool,
 }
 
 impl Default for FeaturesConfig {
@@ -908,13 +913,14 @@ impl Default for FeaturesConfig {
         Self {
             enable_auth: true, // Enable authentication by default
             enable_user_storage_quotas: false,
-            enable_file_sharing: true, // Enable file sharing by default
-            enable_trash: true,        // Enable trash feature
-            enable_search: true,       // Enable search feature
-            enable_music: true,        // Enable music feature
-            enable_places: true,       // Photo map (GET /api/photos/geo + Places tab)
-            enable_faces: false,       // People/faces (biometric) — opt-in, off by default
-            expose_system_users: true, // Expose OxiCloud users as address book by default
+            enable_file_sharing: true,     // Enable file sharing by default
+            enable_trash: true,            // Enable trash feature
+            enable_search: true,           // Enable search feature
+            enable_music: true,            // Enable music feature
+            enable_places: true,           // Photo map (GET /api/photos/geo + Places tab)
+            enable_faces: false,           // People/faces (biometric) — opt-in, off by default
+            expose_system_users: true,     // Expose OxiCloud users as address book by default
+            enable_video_thumbnails: true, // Video thumbs via ffmpeg (if detected)
         }
     }
 }
@@ -1469,6 +1475,13 @@ impl AppConfig {
             config.features.enable_places = val;
         }
 
+        if let Ok(enable_video_thumbnails) =
+            env::var("OXICLOUD_ENABLE_VIDEO_THUMBNAILS").map(|v| v.parse::<bool>())
+            && let Ok(val) = enable_video_thumbnails
+        {
+            config.features.enable_video_thumbnails = val;
+        }
+
         if let Ok(enable_faces) = env::var("OXICLOUD_ENABLE_FACES").map(|v| v.parse::<bool>())
             && let Ok(val) = enable_faces
         {