[AZ-658] frame_ingest H.264/265 decoder (NVDEC + sw fallback)

Wires a real ffmpeg-next 8.1 decoder into the frame_ingest lifecycle
loop. NVDEC is probed at runtime via h264_cuvid / hevc_cuvid; CUDA-less
hosts transparently fall back to software h264 / hevc. Each decoded
frame is stamped with capture_ts (taken at packet receipt) and
decode_ts (taken after decode returns) so movement_detector sees
accurate frame-arrival times. Single-frame decode errors are counted
toward decode_errors_total and dropped; the stream is never aborted.

Adds new public API on FrameIngestHandle: decoder_backend(),
decode_errors_total(), frames_decoded_total(), decode_ms_first_frame(),
decode_ms_p50(), decode_ms_p99(). Integration tests under
crates/frame_ingest/tests/decoder_pipeline.rs cover AC-1, AC-3, AC-4
end-to-end through the real FfmpegDecoder using libx264-encoded
synthetic streams; AC-2 positive (NVDEC selection) is opt-in via
--ignored on a CUDA host. AZ-657 lifecycle tests retained via a
StubDecoder.

Co-authored-by: Cursor <cursoragent@cursor.com>

crates/frame_ingest/tests/rtsp_lifecycle.rs

@@ -17,9 +17,34 @@ use tokio::sync::mpsc;
 use tokio::time::{timeout, Instant};
 
 use frame_ingest::{
-    BackoffPolicy, FrameIngest, OpenError, RtspPacket, RtspSessionConfig, RtspTransport,
-    SessionState, StreamError,
+    BackoffPolicy, DecodeError, DecodedPixels, DecoderBackend, FrameDecoder, FrameIngest,
+    OpenError, RtspPacket, RtspSessionConfig, RtspTransport, SessionState, StreamError,
 };
+use shared::models::frame::PixelFormat;
+
+/// Test-only decoder that pushes one synthetic `DecodedPixels` per
+/// call. Used by the AZ-657 lifecycle tests, which verify FSM /
+/// reconnect / AI-lock semantics — they don't care what pixels the
+/// decoder produced. The production decoder path is exercised
+/// separately by `decoder_pipeline.rs` (AZ-658).
+struct StubDecoder;
+
+impl FrameDecoder for StubDecoder {
+    fn backend(&self) -> DecoderBackend {
+        DecoderBackend::Software
+    }
+
+    fn decode(&mut self, payload: &[u8], out: &mut Vec<DecodedPixels>) -> Result<(), DecodeError> {
+        out.push(DecodedPixels {
+            pixels: Bytes::copy_from_slice(payload),
+            width: 320,
+            height: 240,
+            pix_fmt: PixelFormat::Nv12,
+            decode_duration: Duration::from_micros(100),
+        });
+        Ok(())
+    }
+}
 
 #[derive(Debug, Clone)]
 enum Scripted {
@@ -158,7 +183,11 @@ async fn ac1_open_succeeds_and_session_reaches_streaming() {
     let mut frames = handle.subscribe();
 
     // Act
-    let task = ingest.run(transport, RtspSessionConfig::new("rtsp://fake/0"));
+    let task = ingest.run(
+        transport,
+        StubDecoder,
+        RtspSessionConfig::new("rtsp://fake/0"),
+    );
     let first = timeout(Duration::from_secs(1), frames.recv())
         .await
         .expect("frame within 1 s")
@@ -197,7 +226,11 @@ async fn ac2_bounded_reconnect_recovers_after_transient_failure() {
     let started = Instant::now();
 
     // Act
-    let task = ingest.run(transport, RtspSessionConfig::new("rtsp://fake/0"));
+    let task = ingest.run(
+        transport,
+        StubDecoder,
+        RtspSessionConfig::new("rtsp://fake/0"),
+    );
     let _ = timeout(Duration::from_secs(2), frames.recv())
         .await
         .expect("frame within 2 s")
@@ -233,7 +266,11 @@ async fn ac2b_stream_drop_increments_reopens_total() {
     let mut frames = handle.subscribe();
 
     // Act
-    let task = ingest.run(transport, RtspSessionConfig::new("rtsp://fake/0"));
+    let task = ingest.run(
+        transport,
+        StubDecoder,
+        RtspSessionConfig::new("rtsp://fake/0"),
+    );
     let _ = timeout(Duration::from_secs(1), frames.recv())
         .await
         .expect("first frame")
@@ -268,7 +305,11 @@ async fn ac3_unsupported_profile_hard_fails_session() {
     let handle = ingest.handle();
 
     // Act
-    let task = ingest.run(transport, RtspSessionConfig::new("rtsp://fake/0"));
+    let task = ingest.run(
+        transport,
+        StubDecoder,
+        RtspSessionConfig::new("rtsp://fake/0"),
+    );
     let _ = timeout(Duration::from_secs(1), task)
         .await
         .expect("lifecycle loop exits on hard-fail");
@@ -295,7 +336,11 @@ async fn ac4_ai_lock_toggle_propagates_to_frames() {
     let mut frames = handle.subscribe();
 
     // Act
-    let task = ingest.run(transport, RtspSessionConfig::new("rtsp://fake/0"));
+    let task = ingest.run(
+        transport,
+        StubDecoder,
+        RtspSessionConfig::new("rtsp://fake/0"),
+    );
     let f1 = timeout(Duration::from_secs(1), frames.recv())
         .await
         .expect("first frame")