fix(download): pass Spotify durationMs through to yt-dlp duration filter

- downloads.js: use durationMs (Spotify) before trackTimeMillis (iTunes)
- server: read durationMs from top-level body, not only from tracks[0]
- server: also grab durationMs + trackNum from iTunes in the Spotify path

Without durationMs the duration filter never ran, allowing a 58s fan video
to pass all text filters and be downloaded instead of the actual song.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/ui/downloads.js

@@ -42,7 +42,7 @@ export async function executeDownload() {
     totalTracks: S.downloadTarget.trackCount     || undefined,
     discNum:     S.downloadTarget.discNumber     || undefined,
     discTotal:   S.downloadTarget.discCount      || undefined,
-    durationMs:  S.downloadTarget.trackTimeMillis || undefined,
+    durationMs:  S.downloadTarget.durationMs || S.downloadTarget.trackTimeMillis || undefined,
     ...(ov[_artist] && { artistSort: ov[_artist], albumArtistSort: ov[_artist] }),
     ...(ov[_title]  && { titleSort:  ov[_title]  }),
     ...(ov[_album]  && { albumSort:  ov[_album]  }),