address CodeRabbit review: fix 4 critical + 12 major issues

Critical:
- Remove dead backend.utils.validation PyInstaller hidden import
- Fix story_items table rebuild to preserve track/trim/version columns
- Guard cache migration against same source/destination path
- Fix regeneration audio overwrite (use random uuid suffix per take)

Major:
- Engine selector: validate language on Qwen switch, clear stale modelSize
- Sync language validation regex between profile create and generate (22 langs)
- Guard CUDA download against duplicate concurrent requests
- Only set model_size for engines that support multiple sizes
- Fix 404 swallowed by generic except in history export
- Validate audio_path before FileResponse in export-audio
- Transcription: stream uploads in 1MB chunks, use robust cache check,
  call complete_download() on Whisper download success
- Set clean version as default when effects chain validation fails
- Return explicit error when Windows port occupied by non-voicebox process

backend/routes/cuda.py

@@ -29,6 +29,11 @@ async def download_cuda_backend():
     if cuda.get_cuda_binary_path() is not None:
         raise HTTPException(status_code=409, detail="CUDA backend already downloaded")
 
+    progress_manager = get_progress_manager()
+    existing = progress_manager.get_progress(cuda.PROGRESS_KEY)
+    if existing and existing.get("status") == "downloading":
+        raise HTTPException(status_code=409, detail="CUDA backend download already in progress")
+
     async def _download():
         try:
             await cuda.download_cuda_binary()