Harden backend persistence and packaging

[vindeckyy]

Summary

• Add transactional, versioned JSON state storage with locking, atomic writes, recovery, and stable game IDs.
• Harden request validation, media streaming, background jobs, downloads, archive extraction, deletion paths, plugins, integrations, and packaging.
• Preserve numeric frontend IDs, existing routes, query-token media access, importers, sessions, saves, and visible frontend behavior.
• Add backend hardening tests and a single runtime packaging manifest.

Verification

• ./run_all_tests.sh passes.
• Python compilation, shell syntax, packaging dry-run, and staged diff checks pass.
• Frontend source and assets were not modified.
• The default checked-in AppImage is stale relative to the new manifest and was skipped; explicit AppImage artifacts are hard-validated.

Backup

Verified baseline archive created before mutation:
OpenBox-baseline-20260731T003255Z.tar.gz
with manifest and SHA-256 checksum beside the repository.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3d3dba40-de2d-44c3-972b-dae0a3134bed

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}