Locally stored thumbnails for video and YouTube uploads

- Server-side video thumbnails: ffmpeg-static grabs a frame at ~1s,
  scales it to 480px and stores it under /uploads/thumbs/ at upload
  time (direct files, remote URLs and comment attachments)
- YouTube thumbnails are downloaded once at upload time instead of
  being hotlinked from i.ytimg.com on every render; remote URL kept
  as fallback for legacy rows
- thumbUrl now covers video/audio/youtube/twitch in grid meta,
  profile uploads and notifications
- Generated thumbnail files are removed on single/bulk delete

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

server/utils/uploads.ts

@@ -1,6 +1,6 @@
 import { spawn } from 'node:child_process'
 import { randomInt } from 'node:crypto'
-import { mkdir, readFile, unlink, writeFile } from 'node:fs/promises'
+import { access, mkdir, readFile, unlink, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { eq } from 'drizzle-orm'
@@ -192,6 +192,36 @@ export async function extractAudioMeta(uploadId: string, data: Buffer, mimeType:
   }
 }
 
+// Video-Vorschaubild: Frame bei ~1s per ffmpeg als JPG in thumbs/ ablegen.
+// Bei sehr kurzen Videos liefert -ss 1 kein Frame — dann ohne Seek nochmal.
+export async function extractVideoThumb(key: string, videoPath: string): Promise<string | null> {
+  if (!ffmpegPath || !/^[A-Za-z0-9/_-]+$/.test(key)) return null
+  const outPath = join(uploadDir(), 'thumbs', `${key}.jpg`)
+  const run = (seek: boolean) => new Promise<void>((resolve, reject) => {
+    const proc = spawn(ffmpegPath!, [
+      '-hide_banner', '-loglevel', 'error', '-y',
+      ...(seek ? ['-ss', '1'] : []),
+      '-i', videoPath,
+      '-frames:v', '1',
+      '-vf', 'scale=480:-2',
+      '-q:v', '5',
+      outPath,
+    ])
+    proc.on('error', reject)
+    proc.on('close', code => (code === 0 ? resolve() : reject(new Error(`ffmpeg exit ${code}`))))
+  })
+  const exists = () => access(outPath).then(() => true, () => false)
+  try {
+    await mkdir(dirname(outPath), { recursive: true })
+    await run(true)
+    if (!(await exists())) await run(false)
+    return (await exists()) ? `/uploads/thumbs/${key}.jpg` : null
+  }
+  catch {
+    return null
+  }
+}
+
 // Sprachnachrichten kommen als WebM/Opus o.ä. rein — MediaRecorder kann selbst
 // kein MP3 encodieren, daher serverseitig per ffmpeg nach MP3 transkodieren.
 export async function transcodeVoiceToMp3(data: Buffer): Promise<Buffer | null> {