fix: enforce video view policy on transcription status endpoint

[richiemcilroy]

Fixes #1623.

The AI metadata endpoint gained a VideosPolicy.canView check earlier, but /api/video/transcribe/status still looked videos up by id with no ownership or sharing check, so any signed-in user could poll any video's transcription status. This applies the same policy wrap used by the AI route: public or shared videos still work, everything else returns 404.

Validated with a scoped Biome check; the change mirrors the existing pattern in app/api/video/ai/route.ts.

Greptile Summary

The transcription-status endpoint now enforces the video-view policy before returning status.

• Preserves access for public, shared, and otherwise authorized videos.
• Returns 404 for policy or password denial and 500 for operational failures.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/web/app/api/video/transcribe/status/route.ts	Adds policy-gated video lookup and distinguishes access denial from operational failures, resolving the previously reported error-classification issue.

_{Reviews (3): Last reviewed commit: "fix(web): return clean 500 when transcri..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Web App (apps/web)

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[richiemcilroy]

hey @greptileai, please re-review the PR

[richiemcilroy]

hey @greptileai, please re-review the PR