fix(download): pass Spotify durationMs through to yt-dlp duration filter

- downloads.js: use durationMs (Spotify) before trackTimeMillis (iTunes)
- server: read durationMs from top-level body, not only from tracks[0]
- server: also grab durationMs + trackNum from iTunes in the Spotify path

Without durationMs the duration filter never ran, allowing a 58s fan video
to pass all text filters and be downloaded instead of the actual song.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/novasonic-server.js

@@ -567,7 +567,7 @@ app.post('/api/download', async (req, res) => {
           discTotal:   sp.discCount    || bodyDiscTotal   || undefined,
           genre:       sp.primaryGenreName || sp.genre    || undefined,
           artworkUrl: spArt, explicit: sp.trackExplicitness === 'explicit' || !!explicit,
-          durationMs: sp.durationMs || undefined,
+          durationMs: sp.durationMs || req.body.durationMs || undefined,
         };
         const searchArtist = artist.split(',')[0].trim();
         if (!meta.album) {
@@ -584,6 +584,8 @@ app.post('/api/download', async (req, res) => {
             if (!meta.totalTracks && genreMeta.totalTracks) { meta.totalTracks = genreMeta.totalTracks; }
             if (!meta.discNum     && genreMeta.discNum)     { meta.discNum     = genreMeta.discNum;     }
             if (!meta.discTotal   && genreMeta.discTotal)   { meta.discTotal   = genreMeta.discTotal;   }
+            if (!meta.durationMs  && genreMeta.durationMs)  { meta.durationMs  = genreMeta.durationMs;  }
+            if (!meta.trackNum    && genreMeta.trackNum)     { meta.trackNum    = genreMeta.trackNum;    }
           }
         }
         const finalArtist = meta.itunesArtistName || artist;

src/ui/downloads.js

@@ -42,7 +42,7 @@ export async function executeDownload() {
     totalTracks: S.downloadTarget.trackCount     || undefined,
     discNum:     S.downloadTarget.discNumber     || undefined,
     discTotal:   S.downloadTarget.discCount      || undefined,
-    durationMs:  S.downloadTarget.trackTimeMillis || undefined,
+    durationMs:  S.downloadTarget.durationMs || S.downloadTarget.trackTimeMillis || undefined,
     ...(ov[_artist] && { artistSort: ov[_artist], albumArtistSort: ov[_artist] }),
     ...(ov[_title]  && { titleSort:  ov[_title]  }),
     ...(ov[_album]  && { albumSort:  ov[_album]  }),