Age a stalled transfer from created_at when started_at is missing

The stall clock read started_at and returned zero when it was absent, which
exempted every row written before that column existed -- precisely the jobs
that have been stuck the longest. The live instance had one: a `downloading`
job from before the upgrade, its transfer parked in Queued, Remotely, which
the new check would have skipped forever.

Falls back to created_at, which for a job still in `downloading` is the same
question asked a slightly different way.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_acquisition.py

@@ -253,10 +253,15 @@ def main() -> int:
     check("a 90-minute-old transfer reads as stalled",
           app.stalled_for(job_row("j4")) > app.STALL_MINUTES,
           app.stalled_for(job_row("j4")))
+    # A row written before started_at existed still has to age out, or the
+    # jobs that have been stuck longest are the only ones exempt from the check.
     with app.db() as c:
-        c.execute("UPDATE jobs SET started_at=NULL WHERE id=?", ("j4",))
-    check("a job with no clock is not spuriously stalled",
-          app.stalled_for(job_row("j4")) == 0.0)
+        c.execute("UPDATE jobs SET started_at=NULL, created_at=? WHERE id=?",
+                  ((datetime.now(timezone.utc) - timedelta(days=2))
+                   .isoformat(sep=" ")[:19], "j4"))
+    check("a pre-upgrade row falls back to created_at",
+          app.stalled_for(job_row("j4")) > app.STALL_MINUTES,
+          app.stalled_for(job_row("j4")))
 
     print(f"\n{ok} passed, {fail} failed")
     return 1 if fail else 0