fix: address clawpatch security and reliability findings

[slick-daddy]

Summary

Fixes several confirmed bugs and risk findings reported by clawpatch across the phasher CLI, stash CLI, and Makefile.

Changes

cmd/phasher/main.go

• Return a clear error from getPaths when ffmpeg or ffprobe is not found in PATH, instead of silently passing empty strings downstream
• Guard against empty file extension in printPhash to prevent a runtime panic on files without an extension (e.g. Makefile, README)
• Exit with a non-zero code when any file fails during batch processing

cmd/stash/main.go

• initProfiling now returns (*os.File, error) so the caller can close the file descriptor after pprof.StopCPUProfile; previously the fd was leaked for the entire process lifetime

internal/api/models.go

• convertBaseFile now returns (BaseFile, error) instead of panicking on unknown file types, matching the pattern used by convertVisualFile
• convertBaseFiles updated accordingly

Makefile

• Fixed install target: introduced STASH_BINARY to track the actual binary name separately from the -o flag, preventing broken installs on both Unix and Windows
• Added generate-backend as an explicit dependency of build-release to prevent race conditions under make -j

cmd/stash/main_test.go

• Replaced empty TestStub with real tests for exitError, recoverPanic, and initLogTemp