fix(backend): correct M4A embedded cover extraction and validation

[VoidHandler]

Description
When uploading a soundtrack in .m4a format, the embedded cover doesn't show up because has error extracting the cover.

This PR Fixes embedded soundtrack cover handling for .m4a and other audio formats.

1. Broken M4A extraction — _extract_picture_from_mp4 referenced a non-existent MP4.Cover attribute, causing cover extraction to fail on valid M4A files. Cover MIME is now derived from the actual image bytes instead of broken or unreliable container metadata.
2. Mislabeled cover bytes — non-JPEG/PNG covers (e.g. GIF, or entries with missing/wrong format metadata) were persisted as image/jpeg with a .jpg extension, so clients could not render them. Embedded cover bytes are now validated via magic-byte sniffing; only JPEG and PNG are accepted.
3. Silent cover drops — when has_embedded_cover was true but extraction or persistence failed, the track was saved with missing cover art and incorrect metadata. Upload and scan callers now log the failure and set has_embedded_cover=False.

Checklist

• I've tested the changes locally
• I've updated relevant comments
• I've assigned reviewers for this PR
• I've added unit tests that cover the changes

Screenshots (if applicable)

N/A (backend-only fix)

---

AI assistance disclosure

This PR was developed with Cursor AI assistance (writing unit tests and MIME type detection).
I verified the fix against real M4A, FLAC, MP3, OGG and WAV files.

[greptile-apps]

Greptile Summary

This PR fixes embedded audio cover extraction and persistence. The main changes are:

• MP4 cover MIME detection now uses image bytes instead of container metadata.
• Embedded cover data is limited to JPEG and PNG by magic-byte checks.
• Upload and scan paths clear has_embedded_cover when cover persistence returns no path.
• Tests cover MP4 extraction, MIME sniffing, unsupported covers, and persistence failure handling.

Confidence Score: 4/5

This is close, but the cover failure path should be fixed before merging.

• MP4 MIME detection and JPEG/PNG validation address the mislabeled-cover path.
• Extraction failures are still returned as None, which callers treat as no embedded cover.
• Tracks can still be saved with incorrect cover metadata after a real extraction failure.

backend/utils/audio_tags.py

Important Files Changed

Filename	Overview
backend/utils/audio_tags.py	Adds JPEG/PNG cover validation and updates extractors, but still turns extraction failures into the no-cover result.
backend/endpoints/roms/soundtrack.py	Clears embedded-cover metadata when upload cover persistence returns no path.
backend/handler/scan_handler.py	Clears embedded-cover metadata when scan cover persistence returns no path.
backend/tests/utils/test_audio_tags.py	Adds focused tests for MP4 cover extraction, MIME sniffing, and persistence failure behavior.

_{Reviews (2): Last reviewed commit: "fix(backend): validate embedded cover fo..." | Re-trigger Greptile}

[greptile-apps]

Cover Errors Still Drop

When extract_embedded_cover raises after the tag scan reported an embedded cover, this catch returns None, the same value used for a file with no cover. The upload and scan paths then set has_embedded_cover=False, so a track with an unreadable or unexpectedly failing embedded cover is still saved successfully with the cover removed from metadata. That keeps the extraction-failure case indistinguishable from the no-cover case for callers.