Fix permissions on demand instead of every launch

Instead of chmod on every app start, catch EACCES (error 13) when
spawning sidecar or ffmpeg, fix permissions, then retry once:
- sidecar spawn: catches permission denied, runs set_executable_permissions
  on the sidecar dir, retries spawn
- ffmpeg: catches permission denied, chmod +x ffmpeg and ffprobe, retries

Zero overhead on normal launches. Only fixes permissions when actually needed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src-tauri/src/commands/media.rs

@@ -50,9 +50,37 @@ pub fn extract_audio(file_path: String, output_path: Option<String>) -> Result<S
     #[cfg(target_os = "windows")]
     cmd.creation_flags(0x08000000);
 
-    let status = cmd
-        .status()
-        .map_err(|e| format!("Failed to run ffmpeg: {e}"))?;
+    let status = match cmd.status() {
+        Ok(s) => s,
+        Err(e) if e.raw_os_error() == Some(13) => {
+            // Permission denied — fix permissions and retry
+            eprintln!("[media] Permission denied on ffmpeg, fixing permissions and retrying...");
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::PermissionsExt;
+                if let Ok(meta) = std::fs::metadata(&ffmpeg) {
+                    let mut perms = meta.permissions();
+                    perms.set_mode(0o755);
+                    let _ = std::fs::set_permissions(&ffmpeg, perms);
+                }
+                // Also fix ffprobe if it exists
+                let ffprobe = ffmpeg.replace("ffmpeg", "ffprobe");
+                if let Ok(meta) = std::fs::metadata(&ffprobe) {
+                    let mut perms = meta.permissions();
+                    perms.set_mode(0o755);
+                    let _ = std::fs::set_permissions(&ffprobe, perms);
+                }
+            }
+            Command::new(&ffmpeg)
+                .args(["-y", "-i", &file_path, "-vn", "-acodec", "pcm_s16le", "-ar", "22050", "-ac", "1"])
+                .arg(output.to_str().unwrap())
+                .stdout(std::process::Stdio::null())
+                .stderr(std::process::Stdio::piped())
+                .status()
+                .map_err(|e| format!("Failed to run ffmpeg after chmod: {e}"))?
+        }
+        Err(e) => return Err(format!("Failed to run ffmpeg: {e}")),
+    };
 
     if !status.success() {
         return Err(format!("ffmpeg exited with status {status}"));