fix(server): secure video temp files and snapshot allowlists

[inureyes]

Summary

• Materialize native-video data and HTTP payloads as create-new 0600 files inside private 0700 directories whose guards exist before blocking writes begin.
• Use the startup-resolved local-video allowlist across HTTP, router-model, and in-process request preparation, with restart behavior documented for native and frame-fallback paths.
• Add deterministic coverage for cancellation after a partial write, forced write failure, Unix modes, startup snapshots, and the in-process constructor.

Test plan

• Focused CUDA-feature library tests: 3 temp lifecycle, 1 request snapshot, 13 existing resolvers, and 1 in-process startup test passed.
• A Qwen2.5-VL 3B 4-bit native data:video/mp4 request answered that the clip was red with 83 prompt and 9 completion tokens; the private temp root was empty before and after.
• Contract gates passed with 123 Python and 49 WebUI checks.
• cargo fmt --all -- --check and git diff --check passed.

CUDA end-to-end coverage was run locally. macOS Metal inference was not run locally.

Fixes #1787