fix(uploads): graceful fallback for browser-unplayable video (HEVC .mov)

macOS screen recordings are HEVC inside a .mov container, which Chromium,
Firefox and stock Electron can't decode. The file uploaded fine and a
server-side ffmpeg poster was generated, but inline <video> playback failed
silently — stuck at 0:00 with no error, since AttachmentRenderer had no error
handling. Root cause: the system had no concept of web-playability.

Server detects, client degrades:
- mediaPlayable.ts: classifyVideoPlayable(mimetype, codec) — tri-state
  (false = known-undecodable e.g. HEVC/ProRes, true = web codec in web
  container, null = unknown/optimistic). Never widens `false` beyond codecs
  that fail everywhere, so ffmpeg-less instances keep prior behaviour.
- probeMediaMeta now captures the video codec_name; the upload finish hook
  stores the verdict in the new attachments.playable column (migration 0007).
- Flag propagated through every serializer: space messages, DMs, WS, and
  federation relay (outbound + inbound) — federation-compatible.
- VideoAttachment component: playable===false renders a download card (poster
  + "Can't play here — download" + name/duration/size) with no dead-player
  flash; otherwise plays inline with an onError fallback to the same card.

Specs updated: uploads.md, database.md, federation.md.

packages/shared/src/types.ts

@@ -244,6 +244,13 @@ export interface Attachment {
   width?: number | null;
   height?: number | null;
   duration?: number | null;
+  /**
+   * Web-playability for video attachments. `false` = the codec can't be
+   * decoded in a browser <video> (e.g. HEVC .mov) so the client renders a
+   * download fallback; `true`/`null` = attempt inline playback (null is the
+   * optimistic unknown case, also covered by the client's onError fallback).
+   */
+  playable?: boolean | null;
   federationStatus?: string | null;
   federationMeta?: string | null;
   createdAt: number;
@@ -1088,6 +1095,9 @@ export interface FederationRelayAttachment {
   width?: number;
   height?: number;
   duration?: number;
+  // Web-playability computed by the origin instance (see Attachment.playable).
+  // Propagated so the receiving instance need not re-probe the codec.
+  playable?: boolean | null;
   thumbnailFilename?: string;
   sourceUrl: string;
 }