fix(downloads): keep numbered filenames unique beyond 999 collisions

[wxhking]

Summary

Fixes #1978.

After note.txt and note (1).txt through note (999).txt exist, the local Downloads helper falls back to the same unchecked PID filename on every save. Two sequential downloads in one process therefore overwrite the first file.

Continue the existing numbered suffix until a free path is found. A regression test creates the 1000 occupied names and verifies that two subsequent saves return different paths and retain both payloads and the original file. The implementation change is confined to unique_download_path(); no API or filename-sanitization behavior changes.

This is separate from #1892, which addresses concurrent inbound attachments in infra/gateway/media/inbound_store.py. This PR addresses sequential saves through POST /api/downloads/local and does not claim concurrent write atomicity.

Target branch

• Base is develop (feature / fix — default)
• Base is main (release/* or hotfix/* only)

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation
• Refactor / chore
• Release / hotfix

Test plan

Windows, Python 3.12.13:

Regression on the original implementation:
1 failed, 5 passed

uv run pytest tests/unit/utils/test_user_downloads.py tests/unit/api/test_local_download.py -q
8 passed

uv run ruff check src tests
All checks passed!

uv run ruff format --check src tests
1183 files already formatted

uv run mypy src/octop
Success: no issues found in 571 source files

cd dashboard && npm run build
built successfully

make all PYTEST_JOBS=4
4492 passed, 199 skipped, 18 warnings in 652.24s
Exit code: 0

• make all passes locally
• Added/updated tests

The complete gate above ran on the final commit without test-file selectors, deselection, or additional skip markers. The 199 skips are the repository's existing platform/optional-resource skips. On this Windows environment, locally installed VC runtime DLLs needed to be registered with os.add_dll_directory() before ONNX imports. After fixing that environment configuration, all previously failing ONNX/knowledge modules and the complete gate passed. No dependency, application, or unrelated test changes are included in this PR.

make install-hooks was enabled. The initial commit hook used the affected download test scope and passed the dashboard build. The final commit has now also passed the complete, unrestricted make all gate reported above.

Checklist

• Updated CHANGELOG.md (if user-facing)
• README / docs updated (not needed)

Prepared with Codex assistance. Public logs omit local paths and personal environment details.