Fix media stop, upload cleanup and review findings

- Stop is a no-op when the collected player unit is already gone
  (raw systemctl stop exits 5 on the Frame; verified 2026-09-29).
- Surface systemd-run stderr when the player can't start.
- Keep the copy error if the cleanup ssh also fails; reject upload
  names that the play path can never accept.
- Allow 60 s for play (ffprobe 30 s + systemd-run 15 s remote).
- Docs: four-hour cap is unconditional; no delete action yet; fix a
  garbled timing sentence.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ui/frame_media_remote.py

@@ -63,7 +63,9 @@ def run(body):
     if action == 'status':
         return status()
     if action == 'stop':
-        subprocess.run(['systemctl', '--user', 'stop', UNIT], check=True, timeout=15)
+        # --collect unloads the unit after it exits; stopping it then is a no-op, not an error.
+        if active():
+            subprocess.run(['systemctl', '--user', 'stop', UNIT], check=True, timeout=15)
         return {'message': 'Media player stopped', **status()}
     if action != 'play':
         raise ValueError('Media action must be list, status, play or stop')
@@ -87,7 +89,9 @@ def run(body):
                '--layout', plan['layout'], '--status', str(STATUS)]
     if body.get('theatre'):
         command.append('--theatre')
-    subprocess.run(command, check=True, capture_output=True, text=True, timeout=15)
+    started = subprocess.run(command, capture_output=True, text=True, timeout=15)
+    if started.returncode:
+        raise RuntimeError('Could not start the media player: ' + (started.stderr.strip() or 'systemd-run exited %s' % started.returncode))
     return {'message': 'Starting Frame Control media', 'plan': plan}