fix: isolate per-job cleanup errors and guard markDone against undefined

runCleanup previously had no try/catch around each expired job, so one
job's markCleaned/delete failure would abort the whole pass, leaving
later expired jobs' files undeleted for that run. Each iteration is now
wrapped in a try/catch that logs and continues; the returned count only
reflects jobs that actually completed the delete+markCleaned sequence.

markDone now guards outputPath/outputMimeType/outputSizeBytes/
conversionDurationSeconds with `?? null`, matching the guard createJob
already has on `quality` — Prisma treats `undefined` in a data object as
"leave the column alone" rather than binding NULL like the old raw SQL
did. Currently unreachable in practice since the worker always passes
real values, but keeps the repository defensive and consistent.

Added a cleanup.test.js case that monkey-patches
prisma.conversionJob.update to reject for one job's cleanedAt update,
asserting a later expired job in the same batch still gets cleaned.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/jobs/jobRepository.js

@@ -54,7 +54,13 @@ export async function markProcessing(prisma, id) {
 export async function markDone(prisma, id, { outputPath, outputMimeType, outputSizeBytes, conversionDurationSeconds }) {
   await prisma.conversionJob.update({
     where: { id },
-    data: { status: 'done', outputPath, outputMimeType, outputSizeBytes, conversionDurationSeconds },
+    data: {
+      status: 'done',
+      outputPath: outputPath ?? null,
+      outputMimeType: outputMimeType ?? null,
+      outputSizeBytes: outputSizeBytes ?? null,
+      conversionDurationSeconds: conversionDurationSeconds ?? null,
+    },
   });
 }