fix(akouo): playback-engine correctness (real seek, decode-failure signaling)

[forkwright]

Closes #386, #387, #398, #399, #400, #401, #402, #403, #404.

Changes

• Engine::seek is a stub that fabricates SeekCompleted and returns the requested position as the position reached #386 / seek() fires SeekCompleted and returns without moving playback — silent no-op stub #398 — real seek. Engine::seek (and the Android seek) were stubs that fabricated SeekCompleted and echoed the requested position. Both now forward a command to the decode task, call the decoder's real seek, and return the decoder's actual post-seek position; a generation counter drops stale pre-seek frames.
• decode_task_fn signals decode errors with None, so the DSP task emits TrackEnded for a track that never played #402 — decode failure vs EOS. The decode→DSP channel now carries DecodeOutcome{Frame,Eos,Failed}, so a decode error (or open failure) is distinct from end-of-stream and never emits TrackEnded.
• Decode hot path and probe_codec run synchronous file I/O on the Tokio executor without spawn_blocking #403 — blocking I/O off the executor (full restructure). All blocking decode/probe file I/O moved off the async runtime: a new decode/blocking.rs runs each decoder on a dedicated thread (works on the current-thread runtime, where block_in_place would panic), and probe_codec is wrapped in spawn_blocking. Regression-proven with yields-to-executor tests.
• notify() holds the event_listeners mutex while invoking on_event, deadlocking on reentrant subscribe_events #400 — reentrant-notify deadlock. notify() snapshots listener handles under the lock and invokes the foreign callbacks after releasing it (the std mutex is not reentrant).
• DSP ring buffer write loop livelocks when a decoded frame is larger than ring buffer capacity #387 — DSP livelock. An oversized frame now emits Error + stops instead of spinning.
• subscribe_events has no unsubscribe API — listener list grows unboundedly across Activity lifecycle #399 — unsubscribe. Android subscribe_events returns an id and gains unsubscribe_events (bounded listeners).
• PlaybackStarted is emitted after spawned tasks can already emit Error/TrackEnded/PlaybackStopped #401 — event ordering. PlaybackStarted is emitted before the decode/dsp tasks spawn.
• cpal output-stream errors are only logged; the engine never emits EngineEvent::Error or recovers #404 — output errors. cpal stream errors surface as EngineEvent::Error via an error channel.

Verification

kanon gate --full green; cargo test --workspace passes (23 binaries). akouo-android compiles + tests host-side (UniFFI scaffolding); Android NDK cross-compile is not exercised on this host.

Notes

Adds an OutputConfig.enabled flag (default true) so headless decode/analysis works without an audio device — a small design addition beyond the nine issues. The f64 DSP hot path allocation profile is unchanged.