fix: un-stick federated video posters — emit asset-arrived for the regenerated thumbnail and name it from the history row

[atomantic]

Summary

A federated video poster never un-stuck from MediaImage's "Syncing" placeholder. Two independent defects in doPullOneAsset (server/services/sharing/peerSyncAssets.js), both fixed here:

• No arrival event for the thumbnail. The receiver-side pull emitted asset-arrived once — for the .mp4 — then regenerated the video's thumbnail with no matching emit. MediaImage matches arrivals on filename alone, so a poster <img> that had already 404'd stayed on the placeholder until a remount even though the bytes were on disk. The regenerated thumbnail now gets its own asset-arrived (kind: 'video-thumbnail').
• Wrong thumbnail name for a stitched final. The name was derived from the mp4 basename. That is only coincidentally correct for a videoGen clip (<jobId>.mp4 beside thumbnail: '<jobId>.jpg'); server/services/videoTimeline/local.js writes a stitched timeline final as timeline-<projectId-slice>-<ts>.mp4 beside an independent randomUUID() history id, and every poster URL the UI builds is /data/video-thumbnails/<row.id>.jpg. So the regenerated file landed under a name nothing ever requests. The name now comes from the synced history row's thumbnail field, resolved by video filename via a new videoThumbnailNameForVideo() reader.

Details worth noting:

• The row rides the wire from a peer, so its thumbnail goes through sanitizeAssetFilename before it can become a path segment; a traversal-shaped value falls back to the stem rather than escaping data/video-thumbnails/.
• The mp4 stem stays the fallback for the window where the asset bytes beat the videoHistory metadata category across — that is the pre-existing behavior, so this is strictly additive and can't regress the clip case.
• The two video-history.json readers in this module now share one readVideoHistoryRows() helper.

Closes #4162

Test plan

• New server/services/sharing/peerSyncAssets.videoThumbnail.test.js (5 cases): timeline-final naming from the history row, videoGen-clip arrival emit, stem fallback when the row has not synced, traversal-shaped thumbnail rejected, and no thumbnail arrival when regeneration returns null (ffmpeg missing). Verified the 3 behavior cases fail against the pre-fix source and pass after.
• cd server && NODE_ENV=test npx vitest run services/sharing/ — 22 files, 579 tests pass.
• cd server && NODE_ENV=test npm test — 29489 pass. The only failures are 2 pre-existing, environment-dependent cases in routes/health.test.js, confirmed failing identically on a clean main checkout.