fix(review): resolve deep-review findings across quickfix batch #2

- Button: `loading` always disables (|| not ??) — stops a double-submit
  when a call-site passes an explicit boolean `disabled` (VideoEditor).
- playlists: track un-ingestable-but-live YouTube ids in the sync baseline
  so a linked playlist containing a private/deleted video converges instead
  of re-classifying it as a pending pull forever; re-attempt ingestion each
  sync so a restored (private->public) video heals, and prune ids that
  leave YouTube.
- SettingsPanel: download-auth section renders an honest error/loading
  state (StateMessage + retry) instead of a bare empty section on a failed
  credentials fetch; HU+EN loadError string.
- tests: reorder-order, partial-failure baseline hold, un-ingestable
  converge/heal/prune, Button loading-disables, download-auth error/retry.

frontend/src/components/ui/Button.tsx

@@ -86,7 +86,10 @@ export const Button = forwardRef<HTMLButtonElement, ButtonProps>(function Button
     <button
       ref={ref}
       type={type ?? "button"}
-      disabled={disabled ?? loading}
+      // `loading` must always disable (see the prop's contract above), even when a call-site also
+      // passes an explicit boolean `disabled` — so `||`, not `??`. With `??`, `disabled={false}`
+      // would shadow `loading` and leave the button clickable mid-mutation (double-submit).
+      disabled={disabled || loading}
       aria-busy={loading || undefined}
       aria-label={label}
       title={label}