feat(queue): 404 on unknown hash, show error in UI

POST /api/queue/cancel answers 404 {"error":"hash not in queue"} for
untracked hashes instead of 200 ok:true. The UI surfaces the server's
error message instead of swallowing it.

doc/structure/overview.md

@@ -36,6 +36,7 @@ Webshare credentials are **optional**: with empty `WEBSHARE_USERNAME`/`WEBSHARE_
 src/             # source (CommonJS)
   index.js       # express app + app.listen at module load (server entry)
   qbt.js         # fake qBittorrent client / download queue; cancelDownload returns a boolean
+  ui-api.js      # Web UI JSON API routes (search, queue add/list/cancel), mounted before static
   mcp.js         # MCP server entry (Streamable HTTP)
   webshare.js    # Webshare API client
   torznab.js     # Torznab caps/feed builders
@@ -48,7 +49,7 @@ compose.yaml     # Docker Compose
 data/            # host download data dir (Compose mount target)
 ```
 
-The `src/` modules: `qbt.js` is the shared download engine used by both the Web UI queue and the fake qBittorrent API; `cancelDownload(hash)` returns a boolean indicating whether a matching download was cancelled.
+The `src/` modules: `qbt.js` is the shared download engine used by both the Web UI queue and the fake qBittorrent API; `cancelDownload(hash)` returns a boolean indicating whether a matching download was cancelled. The UI-facing JSON routes live in `ui-api.js` (extracted from `index.js` so they are testable with supertest); see [Web UI JSON API](./ui-api.md) for their contracts, including the `404` on cancelling a hash that is not in the queue. The fake qBittorrent API in `qbt.js` deliberately keeps its always-`Ok.` contract for real *arr clients.
 
 ## Build / test / run (verified)