feat(render+admin): stop a render job (admin, any owner)

The render-queue cancel button used the owner-scoped /cancel (WHERE user_id=…),
so an admin couldn't stop another user's job. Added:
- render-svc: POST /v1/renders/:job_id/stop (admin-gated) → store.StopJob cancels
  any in-progress job regardless of owner and frees the assigned node
- admin: render-queue button now "توقف" → /api/admin/renders/{id}/stop (with confirm)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/render/internal/db/db.go

@@ -597,6 +597,24 @@ func (s *Store) CancelJob(ctx context.Context, id, userID uuid.UUID) (bool, erro
 	return tag.RowsAffected() > 0, err
 }
 
+// StopJob cancels any in-progress job regardless of owner (admin action). Also
+// frees the assigned node so it can pick up new work.
+func (s *Store) StopJob(ctx context.Context, id uuid.UUID) (bool, error) {
+	tag, err := s.pool.Exec(ctx, `
+		UPDATE render.render_jobs
+		SET step = 'Cancelled'::render_step, completed_at = NOW(), updated_at = NOW()
+		WHERE id = $1 AND step NOT IN ('Done','Failed','Cancelled')`,
+		id)
+	if err != nil {
+		return false, err
+	}
+	// Release any node that was actively working this job.
+	_, _ = s.pool.Exec(ctx,
+		`UPDATE render.render_nodes SET status = 'Ready'::node_status, current_frame_job_id = NULL, updated_at = NOW()
+		 WHERE current_frame_job_id IN (SELECT id FROM render.frame_jobs WHERE render_job_id = $1)`, id)
+	return tag.RowsAffected() > 0, err
+}
+
 func (s *Store) GetJobProgress(ctx context.Context, id, userID uuid.UUID) (*models.RenderJob, error) {
 	return s.GetJobByID(ctx, id, userID)
 }