add: processing controls — start/hold, pause/resume, retry

Three lifecycle controls on the dashboard, sharing one /api surface and the
status feed:

- Start/hold gate (#11): the watcher tracks the queue but holds processing
  until POST /api/start. Held by default; AV1DAE_AUTOSTART=1 restores start-
  on-boot. NOTE: flips the previous auto-start default.
- Pause/resume the active encode (#10): SIGSTOP/SIGCONT on the ffmpeg process
  (libsvtav1 is in-process, so one signal suspends all its threads). Resumes
  exactly where it left off; the tracker excludes paused time from elapsed.
- Retry a failed file (#3): POST /api/retry?file=NAME moves it from failed/
  back to input/, with a base-name guard against path traversal.

/status now reports running + the failed list; snapshots carry a paused flag.
Verified live: held queue, retry move, traversal -> 400, and a real encode
suspending to process state T on pause and S on resume.

Closes #3
Closes #10
Closes #11

internal/status/status_test.go

@@ -81,6 +81,27 @@ func TestSnapshotPercentAndETA(t *testing.T) {
 	}
 }
 
+func TestSetPausedFlag(t *testing.T) {
+	tr := New()
+	tr.Begin("x.mkv")
+	if tr.Snapshot().Paused {
+		t.Fatal("should not start paused")
+	}
+	tr.SetPaused(true)
+	if !tr.Snapshot().Paused {
+		t.Error("expected paused after SetPaused(true)")
+	}
+	tr.SetPaused(true) // idempotent — must not double-count
+	tr.SetPaused(false)
+	if tr.Snapshot().Paused {
+		t.Error("expected not paused after SetPaused(false)")
+	}
+	tr.Idle()
+	if tr.Snapshot().Paused {
+		t.Error("Idle should clear paused")
+	}
+}
+
 func TestSnapshotIdleNoDivByZero(t *testing.T) {
 	s := New().Snapshot() // no Begin, totalSec 0
 	if s.Percent != 0 || s.ETASec != 0 || s.Phase != PhaseIdle {