fix(api): a refused write is named, in the reader's language

Deep-review round 5, over round 4's own fixes.

- `notifyActionError` preferred the server's `detail` over the caller's translated fallback, and
  `reportFailure` deliberately leaves 403/404/429 to the caller — so for exactly those statuses the
  dozen call sites round 4 converted started printing whatever English a route hand-wrote into an
  otherwise Hungarian UI ("No user with that email.", "Not subscribed to this channel", "Unknown
  job"). A STRUCTURED detail is still preferred: `req` has already run it through `localizeDetail`,
  so it is both localized and more specific. A plain string is not.

- The other half of the same defect, on the backend: round 4's `get_or_404(what="channel")` sweep
  reached exactly ONE of the five identical sites in channels.py and shipped the HU/EN string with
  it, so the Block button said it in Hungarian and the four controls beside it in English. All five
  are converted, and the subscription / share-recipient / scheduler-job 404s with them (two new
  reasons in both locales).

- `PlexCollectionEditor`'s add/remove, take-over and delete were try/finally with no catch — in the
  very file round 4 edited to give `createNew` one. 403 and 404 are the caller's to report, so the
  tick simply never appeared and a CONFIRMED "delete collection" did nothing, silently.

- `UploadDialog` is the only `uploadReq` caller and kept an empty catch whose comment still claimed
  the global error modal had it. It had not since `reportFailure` became shared: a proxy 502 raised
  only the self-clearing connection notice and a 413/403/404 nothing at all, so the dialog snapped
  back to its pre-upload state with no error named. The user's own Cancel stays silent — and since
  a cancel and a network drop both carry status 0, that difference is now a named `isAborted`
  rather than a string literal at each end.

Regression tests for each (5 vitest, 2 pytest, plus two existing assertions corrected), all
mutation-checked: 6 mutations, each red on the assertion it is named after. vitest 1007,
pytest 1127.

frontend/src/lib/actionErrors.test.ts

@@ -57,6 +57,28 @@ describe("notifyActionError", () => {
 
   it("does toast one the caller was left to handle", () => {
     notifyActionError(new HttpError(404, "gone"), "FAILED");
-    expect(notifyMock).toHaveBeenCalledWith({ level: "error", message: "gone" });
+    expect(notifyMock).toHaveBeenCalled();
+  });
+
+  it("says a bare-English server reason in the reader's language, not the server's", () => {
+    // `reportFailure` leaves 403/404/429 to the caller, so for exactly those statuses whatever
+    // English a route hand-wrote went straight into the toast — "No user with that email." in an
+    // otherwise Hungarian UI, while the caller's translated fallback sat unused (round 5).
+    notifyActionError(new HttpError(404, "No user with that email."), "TRANSLATED");
+    expect(notifyMock).toHaveBeenCalledWith({ level: "error", message: "TRANSLATED" });
+  });
+
+  it("still prefers a STRUCTURED reason, which the request layer has already localized", () => {
+    // `req` runs `{code, reason}` through localizeDetail, so `detail` is in the reader's language
+    // AND more specific than the caller's generic fallback — quota numbers, which row is gone.
+    const err = new HttpError(404, "Ez a csatorna már nincs a könyvtárban.", {
+      code: "not_found",
+      reason: "channel",
+    });
+    notifyActionError(err, "TRANSLATED FALLBACK");
+    expect(notifyMock).toHaveBeenCalledWith({
+      level: "error",
+      message: "Ez a csatorna már nincs a könyvtárban.",
+    });
   });
 });