fix(downloads): iPad audio playback + honest non-retryable failure for auth-walled hosts

5a — the public watch page rendered every asset in a <video>, but WebKit (all
iOS browsers) refuses to play an audio-only mp3 in <video>, so shared audio
links were broken on iPad while working on desktop Chromium. public_meta now
flags audio-only assets (codec present, no video stream) and WatchPage renders
a native <audio> in a padded surface card (no artwork exists for these).

5c — a login-walled Facebook post failed as a bare 'unknown', which offered a
misleading Retry. Classify closed-group / cookie-suggestion auth walls as
login_required and genuinely unsupported sites as a new unsupported_host class
(both non-retryable), and drop unknown from the modal's retryable set — an
unclassified failure is most often an unparsed auth wall. The queue row keeps
its own force-retry for real transients.

backend/app/downloads/links.py

@@ -83,6 +83,10 @@ def public_meta(
     from app.downloads import service
 
     source_url = service.reference_url(job, asset)
+    # Audio-only assets (mp3 rips, extracted audio) carry a codec but no video stream. WebKit (all
+    # iOS browsers) refuses to play them inside a <video> element, so the watch page must render a
+    # native <audio> instead — flag it here from the recorded codecs (a real video always has vcodec).
+    is_audio = asset.vcodec is None and asset.acodec is not None
     return {
         "title": (job and job.display_name) or asset.title,
         "uploader": (job and job.display_uploader) or asset.uploader,
@@ -92,6 +96,7 @@ def public_meta(
         "duration_s": asset.duration_s,
         "width": asset.width,
         "height": asset.height,
+        "audio": is_audio,
         "allow_download": link.allow_download,
         "file_url": file_url,
         "poster_url": poster_url,