Add job cancellation to the stats dashboard

- Active jobs on /stats get a cancel button wired to the existing
  download/match cancel endpoints, showing "cancelling..." and an inline
  error when the task already finished.
- Cancelling now sets the status immediately, so a task whose runner died
  in a restart stops showing as "downloading".
- Download streams use a bounded read timeout (10 s connect / 60 s read):
  a stalled socket fails within a minute (previously it could block
  forever), and a task cancelled while stalled is marked cancelled rather
  than error.
- The stats job list reaps stale download/match tasks, so phantom jobs
  never appear on the dashboard.

backend/apps/library/views.py

@@ -465,7 +465,10 @@ class DownloadTaskViewSet(
                 status=status.HTTP_400_BAD_REQUEST,
             )
         DownloadTask.objects.filter(id=task.id).update(
-            cancelled=True, updated_at=timezone.now()
+            cancelled=True,
+            status=DownloadTask.STATUS_CANCELLED,
+            speed=None,
+            updated_at=timezone.now(),
         )
         return Response({"success": True})
 
@@ -508,7 +511,9 @@ class MatchTaskViewSet(
                 status=status.HTTP_400_BAD_REQUEST,
             )
         MatchTask.objects.filter(id=task.id).update(
-            cancelled=True, updated_at=timezone.now()
+            cancelled=True,
+            status=MatchTask.STATUS_CANCELLED,
+            updated_at=timezone.now(),
         )
         return Response({"success": True})