Prefer a system FFmpeg on desktop platforms, verified compatible

[thcp]

Summary

• Fixes [Feature]: watch if ffmpeg is available on the system #414: the desktop app always downloaded its own FFmpeg on macOS and Windows, even when a working system install was already on PATH. On macOS this could force-install a build that doesn't run on an older macOS than the pinned binary assumes, breaking the app outright even though the user's own FFmpeg would have worked.
• Moves the existing "check PATH first" logic (previously Linux-only) into the shared entry point (ensure_ffmpeg) so it applies uniformly on macOS, Windows, and Linux.
• Strengthens verify_ffmpeg() to confirm the binary both runs and has every encoder StemDeck's export pipeline actually calls for (pcm_s16le, flac, libmp3lame, libvorbis, aac) — not just that -version succeeds — so a minimal/stripped system build isn't accepted only to fail later during an export.
• The macOS primary download source (shaka-project) now goes through this same check before being accepted over the evermeet.cx fallback, so a checksum-valid but OS-incompatible primary build no longer gets used silently.
• Docker is unaffected — it installs FFmpeg via apt in the image and never runs this download path.

Test plan

• cargo check / cargo clippy --all-targets clean (no new warnings) via WSL, per the "PR CI doesn't build the Rust desktop app" note
• cargo test — all 37 tests pass, including a new missing_required_encoders_flags_only_the_absent_ones test
• cargo fmt --check clean for the touched lines
• Verified Command::new("ffmpeg") (bare, no .exe) resolves correctly on Windows by confirming this exact codebase already relies on the same pattern for curl (ships as curl.exe on Windows 10/11 by default) in the unguarded download_file path