fix(api): a refused write is named, in the reader's language

Deep-review round 5, over round 4's own fixes.

- `notifyActionError` preferred the server's `detail` over the caller's translated fallback, and
  `reportFailure` deliberately leaves 403/404/429 to the caller — so for exactly those statuses the
  dozen call sites round 4 converted started printing whatever English a route hand-wrote into an
  otherwise Hungarian UI ("No user with that email.", "Not subscribed to this channel", "Unknown
  job"). A STRUCTURED detail is still preferred: `req` has already run it through `localizeDetail`,
  so it is both localized and more specific. A plain string is not.

- The other half of the same defect, on the backend: round 4's `get_or_404(what="channel")` sweep
  reached exactly ONE of the five identical sites in channels.py and shipped the HU/EN string with
  it, so the Block button said it in Hungarian and the four controls beside it in English. All five
  are converted, and the subscription / share-recipient / scheduler-job 404s with them (two new
  reasons in both locales).

- `PlexCollectionEditor`'s add/remove, take-over and delete were try/finally with no catch — in the
  very file round 4 edited to give `createNew` one. 403 and 404 are the caller's to report, so the
  tick simply never appeared and a CONFIRMED "delete collection" did nothing, silently.

- `UploadDialog` is the only `uploadReq` caller and kept an empty catch whose comment still claimed
  the global error modal had it. It had not since `reportFailure` became shared: a proxy 502 raised
  only the self-clearing connection notice and a 413/403/404 nothing at all, so the dialog snapped
  back to its pre-upload state with no error named. The user's own Cancel stays silent — and since
  a cancel and a network drop both carry status 0, that difference is now a named `isAborted`
  rather than a string literal at each end.

Regression tests for each (5 vitest, 2 pytest, plus two existing assertions corrected), all
mutation-checked: 6 mutations, each red on the assertion it is named after. vitest 1007,
pytest 1127.

frontend/src/components/PlexCollectionEditor.tsx

@@ -77,6 +77,11 @@ export default function PlexCollectionEditor({
         return next;
       });
       refresh();
+    } catch (e) {
+      // 403/404 are left to the caller by `req` (see reportFailure), so without this the tick
+      // simply never appeared and the user clicked again — a collection deleted on the Plex server
+      // or flipped read-only failed in silence (deep-review round 5).
+      notifyActionError(e, t("plex.collection.editFailed"));
     } finally {
       setBusy(null);
     }
@@ -88,6 +93,8 @@ export default function PlexCollectionEditor({
     try {
       await api.plexSetCollectionEditable(id, true);
       refresh();
+    } catch (e) {
+      notifyActionError(e, t("plex.collection.editFailed"));
     } finally {
       setBusy(null);
     }
@@ -123,6 +130,10 @@ export default function PlexCollectionEditor({
         return next;
       });
       refresh();
+    } catch (e) {
+      // The worst of the three to lose: the user has just confirmed a destructive dialog, and the
+      // row stayed where it was with nothing said.
+      notifyActionError(e, t("plex.collection.deleteFailed"));
     } finally {
       setBusy(null);
     }