Harden filename handling and test execution

[onfoot]

Motivation

• Improve reliability and maintainability around where videos are stored and how filenames are handled to avoid runtime errors and unsafe filesystem operations.
• Prevent invalid requests from causing server-side failures by validating input to the /download endpoint and returning clear HTTP errors.
• Protect against path traversal in file deletion and make filename sanitization resilient when the sanitized name would otherwise be empty.

Description

• Add application factory and socket initialization in app/__init__.py (create_app) and new runnable entrypoint app/__main__.py so the app can be executed with python -m app.
• Move the Flask logic into a Blueprint in app/views.py (renamed from app/app.py) and register it from the factory.
• Centralize video path handling in app/utils.py with video_directory, list_mp4_video_files, format_filename, and a hardened safe_filename that falls back to video.mp4 when sanitization yields an empty name.
• Validate /download requests to return 400 when url is missing, and harden /delete to resolve real paths and block path traversal while returning 400/404 for invalid or missing targets.
• Update README.md to document the VIDEOS_DIR env var and running instructions, update docker-compose.yml to pass VIDEOS_DIR and use python -m app, and adjust the Dockerfile comment to match.
• Add tests/test_utils.py covering safe_filename (including empty fallback), list_mp4_video_files ordering, format_filename, and a test that /delete rejects path traversal, and add pytest.ini so pytest can import the app package.

Testing

• Ran the test suite with pytest -q and all tests passed: 5 passed in 0.31s.
• Also executed python -m pytest -q to validate package execution discoverability and it completed successfully.