media: H.264 fallback beside every AV1, and the post links the H.264

The AV1-only publish lasted four hours in the wild: the first viewer on
mobile Safari got "bad media error" from the raw file, because a post's
link is fetched raw — Lemmy apps and browsers play that exact URL, with
no <source> negotiation in front of it. The previous commit's note
("--raw ... if that audience matters") had it backwards: the audience
that cannot play AV1 is not a per-post judgement call, it is whoever
happens to open the thread on an iPhone.

So publish-media.sh now emits two encodings and points the post at the
compatible one:

  * Every video transcode also produces <hash>.h264.mp4 (x264 crf 23,
    same denoise, same frames), uploaded beside the AV1 under the AV1's
    hash — the poster's sibling-naming trick, reused, so fetch-media.sh
    finds it by name with nothing to look up.
  * The printed URL to paste into the post is the H.264 one. pict-rs
    can thumbnail it too, so instance thumbnails come back as a bonus.

fetch-media.sh adopting an own-origin .h264.mp4 URL swaps the AV1 back
in as the page's primary when it is on the mount, and records the H.264
as `fallback` in posts.json. The renderer turns a non-empty fallback
into a <source> pair: the AV1 first with an explicit codecs parameter —
both files are video/mp4, so the parameter is the only thing that lets
a non-AV1 browser skip to the file it can play — and the H.264 second.
Browsers with AV1 keep downloading the small file; Safari before 17
gets one that plays instead of an element that will not.

e2e gains the matching conditional gate: a page offering an av01
<source> must offer an .h264.mp4 one, so an AV1 video can never again
ship without its fallback.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

shared/interfaces/Catcrafts.Shared-Model.cppm

@@ -50,6 +50,12 @@ export struct PostMedia {
     // play — and these posts are their video, so the black box is the page.
     // Empty for images, and empty when the instance generated no thumbnail.
     std::string poster;
+    // H.264 rendition of an AV1 video, when tools/publish-media.sh uploaded one
+    // beside it. Non-empty means the renderer emits a <source> pair instead of
+    // a bare src, so a browser without AV1 (Safari before 17, Apple hardware
+    // without the decoder) gets a file it can play. Empty for images and for
+    // videos that need no fallback.
+    std::string fallback;
     std::int64_t width = 0;
     std::int64_t height = 0;
 };
@@ -311,6 +317,7 @@ export std::vector<Post> LoadPosts(std::string_view json) {
                 pm.src    = std::string(mv.Str("src"));
                 pm.kind   = std::string(mv.Str("kind", "image"));
                 pm.poster = std::string(mv.Str("poster"));
+                pm.fallback = std::string(mv.Str("fallback"));
                 pm.width  = mv.Int("w");
                 pm.height = mv.Int("h");
                 // Only the two kinds the renderer knows how to emit. Anything