Fix M3U write permission failure; add recently-downloaded section to dashboard

Playlist M3U regen now writes to a temp file and renames it into place,
so a stray wrong-owner leftover file (root:root, from pre-migration
host-cron runs) can't block nightly writes the way it did last night.
Dashboard now lists tracks added to the beets library in the last 24h
with playlist and format, sourced from a new beets_service.recently_added().

app/services/beets_service.py

@@ -185,6 +185,25 @@ def distinct_groupings(conn: sqlite3.Connection | None = None) -> list[str]:
             conn.close()
 
 
+def recently_added(since: float, limit: int = 200) -> list[dict]:
+    """Tracks whose beets `added` timestamp falls after `since` (epoch
+    seconds) -- drives the dashboard's "downloaded recently" list. Capped
+    at `limit`: a normal nightly batch is tens of tracks, this is just a
+    guard against one huge backfill import flooding the dashboard."""
+    if not db_exists():
+        return []
+    cols = ", ".join(_ITEM_COLUMNS)
+    conn = _connect()
+    try:
+        cur = conn.execute(
+            f"SELECT {cols} FROM items WHERE added >= ? ORDER BY added DESC LIMIT ?",
+            (since, limit),
+        )
+        return [_row_to_dict(row) for row in cur.fetchall()]
+    finally:
+        conn.close()
+
+
 def distinct_formats() -> list[str]:
     """For the library page's format filter dropdown."""
     if not db_exists():