fix: gate M4A to FLAC conversion on a codec probe in every branch

The SAF and local post-download branches used to rush an ffmpeg 'M4A to FLAC' remux whenever the output extension was .flac, which silently upscaled AAC or EAC3 streams into a lossless container. Each branch now mirrors the native worker by probing the primary audio codec before converting: lossless sources (and true FLAC-in-MP4 files) stay in their native container with the right extension, while genuine ALAC/WAV payloads still get remuxed.

Add an outputExt field to DownloadRequestPayload so the Go backend always knows the user-requested container, and use it together with _shouldRequestContainerConversion to pick the right behaviour for shouldPreserveNativeM4a and the Kotlin finalizer. Decryption descriptors no longer force M4A preservation on their own; the codec probe already makes that call correctly.

test/models_and_utils_test.dart

@@ -328,6 +328,7 @@ void main() {
         safRelativeDir: 'Album',
         safFileName: 'Song.flac',
         safOutputExt: 'flac',
+        outputExt: '.flac',
         songLinkRegion: 'ID',
       );
 
@@ -374,6 +375,7 @@ void main() {
         'saf_relative_dir': 'Album',
         'saf_file_name': 'Song.flac',
         'saf_output_ext': 'flac',
+        'output_ext': '.flac',
         'stage_saf_output': false,
         'defer_saf_publish': false,
         'requires_container_conversion': false,