feat(files): download from anywhere — a link box, a pasted link, the palette; the running downloads in a tray

- Files toolbar link box (paste button, Enter); a lone http(s) link pasted onto any page opens the one
  app-wide download dialog, which now names the link; the palette's "Download from a link…" focuses
  the box on its history entry.
- The download tray, bottom right on every page: what waits, runs, is paused or failed (reason +
  Retry, the queue's right-click / "…" menu), and what finished in this tab as "Done · Open" until
  closed; folds to a pill (per-account pref); closed, it stays shut — across a reload — until the
  work changes or something finishes. Back to top steps up over it, the page end keeps clear.
- A finish is announced once: "Downloaded: …", whether a phone plays it, Copy link + Open (toasts
  and notices may carry a second action).
- The inbox's ready notice opens the file in its folder: download_done carries job_id + folder_id.
- GET /api/downloads is the queue only (in flight, failed, finished in the last 10 minutes), with
  each row's source key.

frontend/src/components/ui/Toaster.dom.test.tsx

@@ -208,3 +208,25 @@ describe("Toaster — handing the toasts to another host", () => {
     );
   });
 });
+
+describe("Toaster — a toast's actions", () => {
+  it("shows a second action beside the first; either runs and closes the toast", () => {
+    const copy = vi.fn();
+    const open = vi.fn();
+    render(<Toaster />);
+    act(
+      () =>
+        void notify({
+          level: "success",
+          message: "Downloaded",
+          action: { label: "Copy link", onClick: copy },
+          secondaryAction: { label: "Open", onClick: open },
+        }),
+    );
+    expect(screen.getByRole("button", { name: "Copy link" })).toBeTruthy();
+    fireEvent.click(screen.getByRole("button", { name: "Open" }));
+    expect(open).toHaveBeenCalled();
+    expect(copy).not.toHaveBeenCalled();
+    expect(screen.queryByText("Downloaded")).toBeNull();
+  });
+});