fix(par2): verify existing PAR2 sets describe the source before reusing them

[javi11]

Summary

Addresses the last comment on #184: after a database reset and re-upload, the NZB contained hundreds of extra .par2 entries (527 → 986 files in the reporter's screenshot). Also fixes #274 and the disk leak both stem from.

1. Stale PAR2 sets reused from the shared temp dir (#184)

Root cause. Generated PAR2 sets go to par2.temp_dir (default: OS temp dir, invisible inside Docker). In durable mode they are only removed by the transfer cleaner after verification, so a DB reset orphans them. On the next upload any set whose filename matched the source basename was reused without checking it was built from the same data, and volumes were collected with a loose prefix match that also picked up other uploads' <name>*.vol*.par2 files.

Fix

• New internal/par2/existing.go: parse the main .par2 File Description packets and reuse an on-disk set only if it describes exactly the input files (name, size, MD5 of first 16 KiB, mirroring par2go). Otherwise warn and regenerate.
• Volumes are matched strictly as <base>.volN+M.par2.
• Shared by the native and parpar executors, for single-file and folder sets.

2. Cleaner deleted users' own PAR2 files (#274)

Root cause. transferwriter.roleFor marked any .par2 path as generated_par2, so reused user files were deleted by the cleaner after verification (and by standalone mode right after posting).

Fix

• Par2Executor returns par2.Result{Created, Reused}; Postie posts All(), deletes only Created, and calls Recorder.MarkGenerated for created paths before posting.
• The recorder derives the role from that set instead of the filename. Reused PAR2 files are recorded as originals and follow the delete_original policy.

3. Orphaned sets are now garbage-collected

• Generated files go into <temp_dir>/postie-par2, a directory Postie owns (empty temp_dir still means next to the sources, and nothing is swept there).
• New internal/par2sweep: removes .par2 files in that dir older than 24h that no transfer_files row references and no running job has reserved. A failed store lookup aborts the pass without deleting.
• Runs 5 minutes after startup, then hourly. Jobs reserve every PAR2 file they post (created or reused) until they close.
• Behaviour change: users with an explicit temp_dir will see PAR2 files appear in a postie-par2/ subfolder. Leftovers already in the old location are not swept.

Test plan

• Regression tests: strict volume matching, stale set with same name/different content rejected, folder set rejected when files added/removed/changed, garbage .par2 rejected
• Result split asserted in every existing reuse test (native + parpar executors); recorder role from MarkGenerated; reused PAR2 survives posting in standalone mode
• Sweeper: removes only old, unreferenced, unreserved .par2 files; keeps everything on lookup failure; honours the initial delay. Reservation of created and reused sets released on Close.
• go test -race ./internal/... ./pkg/... green (cmd/web needs the frontend bundle, unrelated)