fix(downloads,sync): bound what one user can make the server fetch, download and spend

SEC-12: the download box accepts an arbitrary http(s) URL and yt-dlp fetches
it from the WORKER, so any approved user could aim the server at the compose
network, the LAN or a cloud metadata endpoint — and read the result off
job.error, where "connection refused" vs "HTTP Error 401" vs "timed out" is a
port scanner. downloads/urlguard.py refuses a URL whose host resolves to a
loopback/private/link-local/reserved address, at enqueue AND again in the
worker (DNS can move in between, and the worker is where the socket opens).
A network-class failure on a `url` job now reports one fixed sentence instead
of the raw transport text; the error CODE is still classified from the
original, so the localized explanation is unchanged. DNS rebinding is
explicitly NOT closed — that needs the connection gated inside yt-dlp — and
the module says so rather than implying more than it does.

SEC-13: `noplaylist` only demotes a video-inside-a-playlist URL to that video,
so a URL that is purely a playlist or channel still expanded into every
entry — one enqueue, unbounded downloads. `playlist_items` pins it to one.
Size was unbounded too: `check_enqueue` compares the CURRENT footprint against
the cap, and a download's size is unknown until it lands, so one job could
overshoot by any amount; the owner's remaining budget is now handed to yt-dlp
as `max_filesize`, applied AFTER the adapter merge so no source adapter can
raise a limit the quota layer set. A join's cut-list is capped at 100: an
accurate join emits two filters per segment into one ffmpeg filter_complex.

SEC-14: the YouTube budget is instance-wide, so one user holding down a
manual sync spent the day for everyone. Per-user (not per-IP — the cost
belongs to the account) 3-per-10-minutes limiters on the two bulk pulls,
subscriptions and playlists, with separate budgets so one does not close the
other. The review also listed /rss, /backfill and /enrich; E3 deleted them,
and search stays unlimited on purpose — it is interactive, not a bulk pull.

Gate: pytest 896 -> 924 (none skipped), vitest 671.

backend/app/routes/downloads.py

@@ -28,6 +28,7 @@ from app.downloads import edit as editmod
 from app.downloads import links as linksmod
 from app.downloads import quota, service, storage
 from app.downloads import upload as uploadmod
+from app.downloads import urlguard
 from app.models import (
     DownloadJob,
     DownloadLink,
@@ -352,6 +353,17 @@ def enqueue_download(
     body: EnqueueDownloadIn, user: User = Depends(require_human), db: Session = Depends(get_db)
 ) -> dict:
     source_kind, source_ref = resolve_source(body.source)
+    # SEC-12: a non-YouTube source is a raw URL the worker will fetch server-side, so refuse the
+    # ones pointing back into our own network BEFORE a job exists. The worker re-checks (DNS can
+    # move between here and the download); see downloads/urlguard.py for what that does and does
+    # not cover.
+    if source_kind == "url":
+        try:
+            urlguard.check_url(source_ref)
+        except urlguard.BlockedUrl as e:
+            raise HTTPException(
+                status_code=422, detail={"code": "url_blocked", "reason": e.reason}
+            ) from e
     spec, profile_id = _resolve_spec(db, user, body.profile_id, body.spec)
     display_name = (body.display_name or "").strip() or None
     try: