Robustness: crash-safe migrations, stale-run sweep, optional prep tools; branded 404

- init_db applies each schema file with executescript (semicolons in triggers
  and string literals no longer break it) and records schema_version itself
  after each file, so a forgotten in-file bump can't re-run an ALTER and crash
  startup. Re-running is a no-op.
- On startup, sweep any job_runs left in 'running' (killed by a restart) to
  'interrupted' so the UI/history don't show a run stuck running forever.
- prep-audio.sh skips loudgain and cue_file cleanly when they aren't installed
  (they aren't in the base image) instead of failing on a missing binary and
  logging errors; pipeline-status.sh routes syslog through a guard so a missing
  `logger` doesn't spew into the job log.
- Add a branded 404 page (rendered to static HTML, no external runtime) via a
  custom exception handler that leaves all other responses, including the login
  redirect, untouched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pipeline/lib/pipeline-status.sh

@@ -43,6 +43,14 @@ mark_info() {                   printf "    %s\n" "$*"; }
 
 section() { printf "\n▎ %s\n" "$*"; }
 
+# syslog / `logger` is not present in the container image. Only call it if it
+# exists, so these lines don't spew "logger: command not found" into the job
+# log on every run. Always returns success.
+slog() {
+  command -v logger >/dev/null 2>&1 || return 0
+  logger -t sldl-pipeline "$@"
+}
+
 # Format an age in seconds as "Nh", "Nd", "Nw", "Nmo".
 human_age() {
   local s=$1
@@ -375,16 +383,16 @@ ${BANNER_TALLY}" "$OUT"
 
 # Always mirror the one-line summary to syslog so journalctl shows last-run
 # state even if Telegram is broken. Warnings get a separate WARN tag.
-logger -t sldl-pipeline "status: $OK ok, $WARN warn, $SKIP skip (see $OUT)"
+slog "status: $OK ok, $WARN warn, $SKIP skip (see $OUT)"
 if (( WARN > 0 )); then
-  logger -t sldl-pipeline "WARN: pipeline-status flagged $WARN issue(s) — see $OUT"
+  slog "WARN: pipeline-status flagged $WARN issue(s) — see $OUT"
 fi
 
 # Send to Telegram. If it fails, log the failure to syslog so the absence of
 # a message in the chat has a corresponding journal entry to grep for.
 if [[ -x ${PIPELINE_DIR:-/app/pipeline}/lib/notify-telegram.sh ]]; then
   if ! ${PIPELINE_DIR:-/app/pipeline}/lib/notify-telegram.sh < "$OUT" 2>/tmp/tg-err; then
-    logger -t sldl-pipeline "WARN: Telegram send failed: $(cat /tmp/tg-err 2>/dev/null | head -c 200)"
+    slog "WARN: Telegram send failed: $(cat /tmp/tg-err 2>/dev/null | head -c 200)"
     rm -f /tmp/tg-err
   fi
 fi