fix(download): pass Spotify durationMs through to yt-dlp duration filter

- downloads.js: use durationMs (Spotify) before trackTimeMillis (iTunes)
- server: read durationMs from top-level body, not only from tracks[0]
- server: also grab durationMs + trackNum from iTunes in the Spotify path

Without durationMs the duration filter never ran, allowing a 58s fan video
to pass all text filters and be downloaded instead of the actual song.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/novasonic-server.js

@@ -567,7 +567,7 @@ app.post('/api/download', async (req, res) => {
           discTotal:   sp.discCount    || bodyDiscTotal   || undefined,
           genre:       sp.primaryGenreName || sp.genre    || undefined,
           artworkUrl: spArt, explicit: sp.trackExplicitness === 'explicit' || !!explicit,
-          durationMs: sp.durationMs || undefined,
+          durationMs: sp.durationMs || req.body.durationMs || undefined,
         };
         const searchArtist = artist.split(',')[0].trim();
         if (!meta.album) {
@@ -584,6 +584,8 @@ app.post('/api/download', async (req, res) => {
             if (!meta.totalTracks && genreMeta.totalTracks) { meta.totalTracks = genreMeta.totalTracks; }
             if (!meta.discNum     && genreMeta.discNum)     { meta.discNum     = genreMeta.discNum;     }
             if (!meta.discTotal   && genreMeta.discTotal)   { meta.discTotal   = genreMeta.discTotal;   }
+            if (!meta.durationMs  && genreMeta.durationMs)  { meta.durationMs  = genreMeta.durationMs;  }
+            if (!meta.trackNum    && genreMeta.trackNum)     { meta.trackNum    = genreMeta.trackNum;    }
           }
         }
         const finalArtist = meta.itunesArtistName || artist;