feat(downloads): a per-site failure catalog — Facebook's walls say why and what to do

A failed Facebook download read "Download failed": yt-dlp words the login wall
(18+ reel, closed group) as "Cannot parse data", which no category matched.
Measured on dev with the owner's cookie before writing a rule — the same text is
the login wall without a cookie and a refused cookie with one.

- errors.diagnose(msg, url, cookie_attached) tries a host-scoped catalog first
  (all-of markers, cookie state, link fragment) and falls back to the category.
  First entries: facebook.login_wall, facebook.cookie_rejected,
  facebook.group_post_video. The module doc is the recipe for the next entry.
- download_jobs.error_detail (0084) + backfill of the stored Facebook parse
  failures that were unknown.
- The pipeline's failure branch passes the link and whether the cookie went
  with it; resume and redownload clear code and detail (redownload never
  cleared error_code).
- A job meeting an already-failed asset got the text but no code, so it read
  "Download failed" where the first job said why. It is diagnosed again, with
  the cookie state from credentials.is_authed_asset (now shared with the
  cookie gate); the redacted network text classifies back to network.
- FE: failCopyKeys gives the row and the failure window one lookup — catalog
  copy, else the category. Copy in EN and HU; a contract test pins every
  backend entry to both locales.

frontend/src/i18n/backendIds.contract.test.ts

@@ -67,6 +67,13 @@ const adminRefusals = [
   ...backend("routes/admin.py").matchAll(/\{\s*"code":\s*"(\w+)",\s*"reason":\s*"(\w+)"/g),
 ].filter((m) => adminCodes.includes(m[1]!));
 const adminReasons = [...new Set(adminRefusals.map((m) => m[2]!))];
+// The download failure catalog's host-specific entries → `downloads.errors.fail.catalog.<detail>`.
+// A code holds a dot (`facebook.login_wall`), so the reverse check strips the prefix and the part
+// rather than splitting on dots.
+const failDetails = [
+  ...new Set([...backend("downloads/errors.py").matchAll(/detail="([\w.]+)"/g)].map((m) => m[1]!)),
+];
+const DETAIL = "downloads.errors.fail.catalog.";
 
 /** The ids under `prefix` a locale names, `prefix.<id>` or `prefix.<id>.<anything>`. */
 const idsUnder = (keys: Set<string>, prefix: string) =>
@@ -83,6 +90,7 @@ describe("backend ids have their names in both languages", () => {
     expect(auditActions).toEqual(expect.arrayContaining(["config_set", "audit_clear"]));
     expect(quotaActions.length).toBeGreaterThan(0);
     expect(adminCodes).toEqual(expect.arrayContaining(["activate", "setpw"]));
+    expect(failDetails).toEqual(expect.arrayContaining(["facebook.login_wall"]));
     // Every code the frontend localizes is raised somewhere the scan can see.
     expect(adminCodes.filter((c) => !adminRefusals.some((m) => m[1] === c))).toEqual([]);
   });
@@ -117,6 +125,18 @@ describe("backend ids have their names in both languages", () => {
       expect(quotaActions.filter((a) => !idsUnder(keys, "quotaActions").has(a))).toEqual([]);
     });
 
+    it(`${lang}: every download failure-catalog entry`, () => {
+      expect(
+        missing(failDetails.flatMap((d) => [`${DETAIL}${d}.short`, `${DETAIL}${d}.body`])),
+      ).toEqual([]);
+      const named = new Set(
+        [...keys]
+          .filter((k) => k.startsWith(DETAIL))
+          .map((k) => k.slice(DETAIL.length).replace(/\.(short|body)$/, "")),
+      );
+      expect([...named].filter((d) => !failDetails.includes(d))).toEqual([]);
+    });
+
     it(`${lang}: every admin refusal reason`, () => {
       expect(missing(adminReasons.map((r) => `errors.admin.${r}`))).toEqual([]);
       expect([...idsUnder(keys, "errors.admin")].filter((r) => !adminReasons.includes(r))).toEqual(