Add job cancellation to the stats dashboard

- Active jobs on /stats get a cancel button wired to the existing
  download/match cancel endpoints, showing "cancelling..." and an inline
  error when the task already finished.
- Cancelling now sets the status immediately, so a task whose runner died
  in a restart stops showing as "downloading".
- Download streams use a bounded read timeout (10 s connect / 60 s read):
  a stalled socket fails within a minute (previously it could block
  forever), and a task cancelled while stalled is marked cancelled rather
  than error.
- The stats job list reaps stale download/match tasks, so phantom jobs
  never appear on the dashboard.

backend/apps/library/services.py

@@ -250,13 +250,24 @@ class DownloadCancelled(Exception):
 
 
 def download_file(
-    url, destination, progress_callback=None, should_cancel=None
+    url,
+    destination,
+    progress_callback=None,
+    should_cancel=None,
+    read_timeout=60,
 ):
-    """Stream a remote file into destination (used by Download to Library)."""
+    """Stream a remote file into destination (used by Download to Library).
+
+    The read timeout bounds how long a stalled connection can block the
+    worker: without it a hung socket would keep a job "downloading" forever
+    and the cancel flag could never be observed.
+    """
     import requests
 
     headers = {"User-Agent": settings.USER_AGENT}
-    with requests.get(url, headers=headers, stream=True, timeout=120) as response:
+    with requests.get(
+        url, headers=headers, stream=True, timeout=(10, read_timeout)
+    ) as response:
         response.raise_for_status()
         total = int(response.headers.get("content-length") or 0)
         downloaded = 0