fix: review findings — chain NaN/Inf + id hygiene, percent-escape jobPath, shared singleVideoResult

- SubmitChain rejects NaN/±Inf segment seconds with ErrUnsupported
  (previously an obscure json.Marshal error; NaN fails every comparison
  and +Inf passed the >= 0 check).
- ChainStatus skips segment entries with no usable id — JSON null
  (which no-op-unmarshals into a string, previously appending ""),
  empty strings, and id-less objects; the unfiltered list survives in
  Raw. ChainJob.SegmentIDs doc now also says ChainSegmentResult takes
  the segment index, not an id string.
- jobPath rejects '%' in job ids — %2F/%2E%2E percent-escapes decode
  back into path structure server-side, bypassing the literal check on
  this upstream-echoed value.
- singleVideoResult moves to video.go next to videoMIME, and the two
  remaining hand-rolled copies of the video-result validation
  (videoModel.Generate, Interpolate) now use it — one validation, one
  message shape.
- videogen.LipSyncer renamed to videogen.Lipsyncer for consistency with
  the rest of the surface's Lipsync* naming (LipsyncProvider,
  LipsyncModel, LipsyncRequest); not yet consumed downstream, so the
  rename is free now and never again.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WWCQcYStWXBYUy5sZWnbLT

provider/llamaswap/video.go

@@ -100,22 +100,7 @@ func (m *videoModel) Generate(ctx context.Context, req videogen.Request, opts ..
 	if err != nil {
 		return nil, err
 	}
-	if len(videoBytes) == 0 {
-		return nil, &llm.APIError{Provider: m.p.name, Model: m.id, Message: "video response contained no video"}
-	}
-	mimeType := videoMIME(contentType, videoBytes)
-	if mimeType == "" {
-		// A 2xx body that is neither declared nor sniffable as video is a
-		// misconfigured upstream (a JSON job envelope, an HTML error page
-		// behind a proxy) — fail loud rather than hand back garbage as a
-		// playable clip.
-		return nil, &llm.APIError{
-			Provider: m.p.name,
-			Model:    m.id,
-			Message:  fmt.Sprintf("video response is not a video (content-type %q)", contentType),
-		}
-	}
-	return &videogen.Result{Video: videogen.Video{Data: videoBytes, MIME: mimeType}}, nil
+	return singleVideoResult(m.p.name, m.id, "video", videoBytes, contentType)
 }
 
 // videoMIME resolves the result MIME type: the response Content-Type when it
@@ -132,6 +117,24 @@ func videoMIME(contentType string, data []byte) string {
 	return ""
 }
 
+// singleVideoResult wraps one raw video body into a videogen.Result,
+// requiring positive evidence of video-ness (declared video/* Content-Type
+// or sniffed mp4/webm magic) so a 2xx body that is anything else — a JSON
+// job envelope, an HTML error page behind a proxy — fails loud instead of
+// coming back as "the clip". The video sibling of singleImageResult, shared
+// by every surface whose response body IS the encoded clip.
+func singleVideoResult(provider, model, verb string, raw []byte, contentType string) (*videogen.Result, error) {
+	if len(raw) == 0 {
+		return nil, &llm.APIError{Provider: provider, Model: model, Message: verb + " response contained no video"}
+	}
+	mimeType := videoMIME(contentType, raw)
+	if mimeType == "" {
+		return nil, &llm.APIError{Provider: provider, Model: model,
+			Message: fmt.Sprintf("%s response is not a video (Content-Type %q)", verb, contentType)}
+	}
+	return &videogen.Result{Video: videogen.Video{Data: raw, MIME: mimeType}}, nil
+}
+
 // initImageFilename picks the multipart filename hint for the conditioning
 // frame from its MIME subtype. The name is provider-chosen (never
 // caller-supplied), so no sanitization is needed.