fix(api): stop leaking raw ffprobe stderr in media validation errors

An unrecognized/corrupt media upload threw an InputValidationError whose message embedded the raw ffprobe stderr ('ffprobe exited 1: ...'). Return a clean 'Unrecognized <kind> file' message to the client and log the raw probe failure via logger.warn instead. Found via the round-2 hostile-input gap test.

apps/api/src/modality/media-input.ts

@@ -4,6 +4,7 @@ import { extname, join } from "node:path";
 import { probeMedia } from "@snapotter/media-engine";
 import { SUBTITLE_INPUTS } from "@snapotter/shared";
 import { env } from "../config.js";
+import { logger } from "../lib/logger.js";
 import { type InputHandler, InputValidationError, type PreparedInput } from "./contract.js";
 
 export type MediaInputKind = "video" | "audio" | "image" | "subtitle";
@@ -38,8 +39,10 @@ export class MediaInputHandler implements InputHandler {
       try {
         info = await probeMedia(probePath);
       } catch (err) {
+        // Keep the raw ffprobe failure in logs; never surface it to the client.
+        logger.warn({ err, kind: this.kind }, "media input probe failed");
         throw new InputValidationError(
-          `Unrecognized ${this.kind} file: ${err instanceof Error ? err.message : String(err)}`,
+          `Unrecognized ${this.kind} file. It may be corrupt or in an unsupported format.`,
         );
       }
       const hasVideo = info.streams.some((s) => s.type === "video");