Replace detached worker lifecycle with an owned task supervisor

[debpalash]

Problem

The process currently has roughly 215 std.Thread.spawn call sites and 177 detached-thread call sites. src/core/work_pool.zig says it replaces detached, unbounded, unjoinable work, but it is not used by application code. The lightweight tracker in src/core/workers.zig covers only a small subset of workers.

During appDeinit(), Opal drains tracked workers for at most 800 ms and then destroys player state, the shared HTTP client, logs, and the global allocator. Untracked workers in podcasts, Jellyfin, anime, and other services may still be running.

Acceptance criteria

• A process-owned supervisor is initialized before services and shut down before shared state/allocators.
• Submitted work is bounded and supports cancellation/backpressure.
• Every application worker is owned and joinable; raw .detach() is limited to an explicitly documented low-level exception, if any.
• Podcasts, Jellyfin, anime, comics, YouTube, and startup workers are migrated.
• Shutdown stops admission, signals cancellation, joins all owned workers, and only then deinitializes shared resources.
• A timed-out worker produces a visible diagnostic and cannot continue into freed state.
• CI rejects new unmanaged spawn/detach sites.
• A stress test repeatedly exits while network/decode work is active without leaks, late writes, or crashes.

Relevant files: src/main.zig, src/core/workers.zig, src/core/work_pool.zig.