stream: fallback only replays already-aired tracks

The fallback played the whole /cache directory, which at cold start holds
only the 2-3 tracks being pre-fetched — so it looped them until the
request.dynamic buffer filled. Restrict the fallback to tracks already
aired: the ingest daemon exposes them at GET /fallback.m3u (played_at set,
still on disk), and the stream fetches that into a local /tmp/fallback.m3u
that playlist watches. Cold start is now silent (assumed) instead of a tight
loop, and a mid-stream drain degrades across the whole listening history.

A local file (not a remote playlist URL) is used to avoid Liquidsoap's http
resolver mis-sniffing the response as text/html; mime_type is forced so an
empty header-only m3u still parses.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ingest/radieo/db.py

@@ -141,6 +141,20 @@ class Database:
                 (path, track_key),
             )
 
+    def played_files(self, limit: int) -> list[str]:
+        """Files already aired, newest first (the stream's fallback pool).
+
+        Only played tracks appear here, so files still being pre-fetched are
+        never served as fallback — that is what stopped the cold-start loop.
+        """
+        with self._lock:
+            rows = self._conn.execute(
+                "SELECT path FROM cache_files WHERE played_at IS NOT NULL"
+                " ORDER BY played_at DESC LIMIT ?",
+                (limit,),
+            ).fetchall()
+        return [r["path"] for r in rows]
+
     def mark_played(self, path: str) -> None:
         with self._lock:
             self._conn.execute(