feat(files): download from anywhere — a link box, a pasted link, the palette; the running downloads in a tray

- Files toolbar link box (paste button, Enter); a lone http(s) link pasted onto any page opens the one
  app-wide download dialog, which now names the link; the palette's "Download from a link…" focuses
  the box on its history entry.
- The download tray, bottom right on every page: what waits, runs, is paused or failed (reason +
  Retry, the queue's right-click / "…" menu), and what finished in this tab as "Done · Open" until
  closed; folds to a pill (per-account pref); closed, it stays shut — across a reload — until the
  work changes or something finishes. Back to top steps up over it, the page end keeps clear.
- A finish is announced once: "Downloaded: …", whether a phone plays it, Copy link + Open (toasts
  and notices may carry a second action).
- The inbox's ready notice opens the file in its folder: download_done carries job_id + folder_id.
- GET /api/downloads is the queue only (in flight, failed, finished in the last 10 minutes), with
  each row's source key.

frontend/src/lib/notifications.ts

@@ -60,6 +60,8 @@ export interface Notification {
   title?: string;
   message: string;
   action?: NotifAction;
+  // A second, lesser action beside it (a done download's "Open" after its "Copy link").
+  secondaryAction?: NotifAction;
   meta?: NotifMeta;
   requiresInteraction: boolean;
   duration?: number; // auto-dismiss ms (undefined when it stays until acted on)
@@ -82,6 +84,7 @@ export interface NotifyInput {
   level?: NotifLevel;
   title?: string;
   action?: NotifAction;
+  secondaryAction?: NotifAction;
   meta?: NotifMeta;
   requiresInteraction?: boolean;
   sound?: boolean; // force the alert tone (when sound is enabled) even for an info toast
@@ -185,6 +188,7 @@ function load(): Notification[] {
           repeat: 1,
           ...(n as object),
           action: undefined,
+          secondaryAction: undefined,
           dismissed: true,
           transient: false,
         }) as Notification,
@@ -198,7 +202,9 @@ function persist() {
   try {
     // Transient status notices are live-session only — never write them to history,
     // so a reload can't leave one stranded with no producer left to clear it.
-    const slim = items.filter((n) => !n.transient).map(({ action: _action, ...n }) => n);
+    const slim = items
+      .filter((n) => !n.transient)
+      .map(({ action: _action, secondaryAction: _second, ...n }) => n);
     writeAccount(HISTORY_KEY, slim);
   } catch {
     /* ignore quota / serialization errors */
@@ -317,6 +323,7 @@ export function notify(input: NotifyInput): number {
       title: input.title,
       message: input.message,
       action: input.action,
+      secondaryAction: input.secondaryAction,
       meta: input.meta,
       requiresInteraction,
       duration,