fix(i18n): every refusal the API answers is structured and said in the reader's language

~150 HTTPExceptions carried a hand-written English sentence as their detail,
shown verbatim under the Hungarian UI — in the blocking error dialog and on
every inline surface that printed HttpError.detail (sign-in, setup wizard,
change password, the passphrase gate, live search). Four also quoted an
upstream exception's text back to the user.

- app/refusal.py: `refused(status, reason, **params)` → {code: "refused",
  reason, …params}; localizeDetail translates errors.refused.<reason> with the
  params interpolated. "Unknown X" 404s use the existing not_found(what).
- sysconfig.set_value raises InvalidSetting (reason + bounds) instead of an
  English ValueError; the three writers answer it through setting_refused.
- The Plex connection/write/image failures log what the upstream said and
  answer a reason; the search scraper's failure is logged and answered as
  youtube/unavailable (it crashed refusal_reason before).
- HttpError.detail now only ever holds a translated reason: a string detail
  (only the framework's own can remain) is left out, so reading .detail is
  safe everywhere — including destructured, the hole the raw-detail source
  scan could not see. That scan and its five-file exception list are gone.
- Enforced: test_http_details.py fails on any HTTPException with a sentence
  for a detail; the contract test requires every refused reason and every
  not_found "what" in both languages, and no key for one that is gone.
- local/jsx-comment-text: a // inside JSX children renders as text; the rule
  is ten lines in eslint.config.js rather than eslint-plugin-react's ~1800
  lockfile lines.

frontend/src/lib/api/core.test.ts

@@ -123,6 +123,17 @@ describe("uploadReq", () => {
     expect(reportError).toHaveBeenCalledWith("downloads.errors.upload.tooLarge");
   });
 
+  it("offers no string detail as the reason on the upload path either", async () => {
+    const p = uploadReq("/u", form());
+    const x = FakeXHR.last;
+    x.status = 405;
+    x.responseText = '{"detail":"Method Not Allowed"}';
+    x.onload!();
+    const err = (await p.catch((e: unknown) => e)) as HttpError;
+    expect(err).toBeInstanceOf(HttpError);
+    expect(err.detail).toBeUndefined();
+  });
+
   it("reports a connectivity failure on a network error", async () => {
     const p = uploadReq("/u", form());
     FakeXHR.last.onerror!();
@@ -168,6 +179,23 @@ describe("req — a structured refusal reads in the user's language", () => {
     });
   });
 
+  it("never offers a string detail as the reason — only a structured one, translated", async () => {
+    // Every refusal the app answers is structured; a string can only be the framework's own English
+    // ("Method Not Allowed"). Surfaces print `err.detail` — some destructured, out of any source
+    // scan's reach — so the guarantee has to live here, where the value is made.
+    vi.spyOn(globalThis, "fetch").mockResolvedValue(
+      new Response(JSON.stringify({ detail: "Method Not Allowed" }), {
+        status: 405,
+        headers: { "content-type": "application/json" },
+      }),
+    );
+    const err = (await req("/api/x", { method: "POST" }, { quiet: true }).catch(
+      (e: unknown) => e,
+    )) as HttpError;
+    expect(err).toBeInstanceOf(HttpError);
+    expect(err.detail).toBeUndefined();
+  });
+
   it.each(["quota", "reconnect", "unavailable"])(
     "says what to do about an action YouTube refused (%s)",
     async (reason) => {

frontend/src/lib/api/core.ts

@@ -50,7 +50,12 @@ export function isAborted(err: unknown): boolean {
 
 export class HttpError extends Error {
   status: number;
-  detail?: string; // server-provided reason (FastAPI's `detail`), when present
+  // The server's reason IN THE READER'S LANGUAGE, when it gave one — i.e. a structured detail run
+  // through `localizeDetail`, never the raw text of a string detail. Every refusal the app answers is
+  // structured (backend `app/refusal.py`, enforced by its test_http_details.py); a string can only be
+  // the framework's own ("Method Not Allowed"), so it is left out rather than shown. That is what
+  // makes reading `.detail` safe anywhere — including destructured, which no source scan could see.
+  detail?: string;
   detailData?: unknown; // structured detail ({ code, reason, ... }) when the server sent an object
   constructor(status: number, detail?: string, detailData?: unknown) {
     super(detail || `HTTP ${status}`);
@@ -133,6 +138,11 @@ function localizeDetail(d: unknown): string {
   // wait for the budget, reconnect, or retry. An unknown reason reads as the retryable one.
   if (o?.code === "youtube")
     return t(`errors.youtube.${o.reason}`, t("errors.youtube.unavailable"));
+  // Every other refusal (backend `app/refusal.py`): one family, the reason naming the sentence and
+  // the rest of the detail its values (`{{min}}`, `{{name}}`, …). A reason this build does not know
+  // reads as the generic failure rather than a key.
+  if (o?.code === "refused")
+    return t(`errors.refused.${o.reason}`, { ...o, defaultValue: t("errors.generic") });
   // A playlist action the server refused (Watch later can't be deleted, YouTube said no, …).
   if (o?.code === "playlist") return t(`playlists.errors.${o.reason}`, t("errors.generic"));
   // An admin action on an account or an invite that the server refused: activating an address that
@@ -326,8 +336,8 @@ export async function req<T = unknown>(
       let detailData: unknown;
       try {
         const body = await r.json();
-        if (body && typeof body.detail === "string") detail = body.detail;
-        else if (body && body.detail && typeof body.detail === "object") {
+        // A string detail is not the app's (see `HttpError.detail`) and is not shown.
+        if (body && body.detail && typeof body.detail === "object") {
           detailData = body.detail;
           detail = localizeDetail(body.detail); // structured error → localized message
         }
@@ -393,8 +403,8 @@ export function uploadReq<T = unknown>(
       let detailData: unknown;
       try {
         const body = JSON.parse(xhr.responseText);
-        if (body && typeof body.detail === "string") detail = body.detail;
-        else if (body && body.detail && typeof body.detail === "object") {
+        // A string detail is not the app's (see `HttpError.detail`) and is not shown.
+        if (body && body.detail && typeof body.detail === "object") {
           detailData = body.detail;
           detail = localizeDetail(body.detail);
         }