[thcp]

Closes #824

Product change (flagged)

• libvorbis is no longer required. Without it StemDeck starts and works; only OGG export is unavailable.
• The export menu shows OGG disabled with the reason "OGG export is unavailable: it needs an FFmpeg with Vorbis support."
• A forced OGG request (mixdown.ogg, stems/all.zip?format=ogg) answers 422 with an actionable message, no render started.

What changed

• Shell: REQUIRED_FFMPEG_ENCODERS = pcm_s16le, flac, libmp3lame, aac. libvorbis moves to OPTIONAL_FFMPEG_ENCODERS.
• Backend: app/pipeline/audio_encoders.py probes ffmpeg -encoders once per binary (cached on ffmpeg_identity()).
• /api/health gains export_formats: {"wav","mp3","flac","ogg": bool} or null when unknown. No paths.
• Download errors name the URL and say whether the server was reached (HTTP 429 and other HTTP errors) or the binary was rejected. curl runs --silent, so no progress meter in the message.
• The macOS setup error ends with the next step: brew install ffmpeg, ffmpeg-full for OGG, STEMDECK_FFMPEG, Rosetta where relevant.
• Guide: help.exportFormat mentions the greyed-out OGG, all ten tables plus pt-PT.

New macOS order (Apple Silicon and Intel)

1. STEMDECK_FFMPEG (error if it fails). STEMDECK_FFMPEG_URL skips step 3 and downloads only from that URL.
2. Data-folder pair that passes the check and is native.
3. Installed pair that passes, one with libvorbis first:
   • Apple Silicon: /opt/homebrew/bin, /opt/homebrew/opt/ffmpeg-full/bin, /usr/local/bin, /opt/local/bin, PATH. Intel-only binaries skipped.
   • Intel: /usr/local/bin, /usr/local/opt/ffmpeg-full/bin, /opt/local/bin, PATH.
4. Data-folder pair that runs only via Rosetta (kept, not downloaded over).
5. Download: shaka per-architecture primary (now passes), then evermeet only on Intel or with Rosetta. Each source staged separately, installed only after the checks.

What did not change

• Windows and Linux: a system FFmpeg on PATH still needs libvorbis to win over the download. Their downloads include libvorbis, so they pass as before.
• On Windows and Linux a data-folder pair without libvorbis now passes the check instead of being re-downloaded.
• Linux curl download errors (runtime pack and FFmpeg) get the new wording. Retries are unchanged.
• No retries added. Pinned URLs and hashes unchanged. uv.lock untouched, runtime id unchanged. No new dependencies.

Risks

• A user with Homebrew's plain ffmpeg gets no OGG until they install ffmpeg-full and delete the data-folder pair. Setup does not re-run once a pair passes.
• The installed-pair search runs fixed paths it did not run before (/usr/local/bin, MacPorts).

Checks (macOS arm64, ffmpeg 9.0.2 without libvorbis)

• cargo fmt --check, cargo test (179 passed), clippy with the macos-check flags: pass. clippy --tests -D warnings: only the 4 existing errors.
• pytest: 3333 passed, 15 skipped (the 5 OGG renders skip here). ruff, ruff format, bandit (no medium or high): clean. i18n coverage: clean.
• Playwright: export-ogg (new), export-menu, help-mode pass. Local full suite: 690 passed, 11 failed. Every failure passes on rerun or also fails on plain big-release (trash-restore x3, footer-time, karaoke, grid-value-box). PR CI e2e shards: green.
• PR CI: Linux, Windows and macOS Rust Check all green.
• Real check against an isolated backend: health reports ogg: false, WAV/MP3/FLAC mixdowns and the MP3 zip export, OGG returns 422.

Not tested

• A real first launch on an Apple Silicon Mac without ffmpeg, an Intel Mac with ffmpeg in /usr/local/bin, and the Rosetta cases. The decision logic is unit-tested for each.