Robustness cleanups: dead consts, stream ordering, takePending atomicity, misc

[miridius]

From the /review-pr baseline:

• src/consts.ts: hostname (shells out at import time, never consumed), secret (unused), stray empty-template-literal statement (line 13). Remove all three.
• src/download-video.ts execYtdlp: stderr fully drained before stdout is read; large stdout can fill the pipe buffer and deadlock until the 300s SIGTERM. Read both streams concurrently (probeDuration/updateYtdlp already do).
• src/pending-downloads.ts takePending: read-then-unlink is non-atomic (double-confirm race) and the take/putPending rollback in handlers.ts:134-143 can resurrect a consumed entry. Check ownership before take.
• handlers.ts:217 inline cache chat id -4640446184 is hardcoded (existing TODO) — make configurable, document in README.
• UID=$(id -u) is readonly under bash; works under dash but a HOST_UID rename in compose + scripts would be portable.
• scripts/update-fixtures.ts exits 0 even when every fetch failed; learning-test.sh read -p breaks non-interactively.
• urlRegex matches bare tokens like "e.g" in inline queries → spurious yt-dlp spawns.