fix(downloads): iPad audio playback + honest non-retryable failure for auth-walled hosts

5a — the public watch page rendered every asset in a <video>, but WebKit (all
iOS browsers) refuses to play an audio-only mp3 in <video>, so shared audio
links were broken on iPad while working on desktop Chromium. public_meta now
flags audio-only assets (codec present, no video stream) and WatchPage renders
a native <audio> in a padded surface card (no artwork exists for these).

5c — a login-walled Facebook post failed as a bare 'unknown', which offered a
misleading Retry. Classify closed-group / cookie-suggestion auth walls as
login_required and genuinely unsupported sites as a new unsupported_host class
(both non-retryable), and drop unknown from the modal's retryable set — an
unclassified failure is most often an unparsed auth wall. The queue row keeps
its own force-retry for real transients.

backend/tests/test_links.py

@@ -4,7 +4,14 @@ token, rides in the file URL (a <video src> can't send a header), and expires.""
 from datetime import datetime, timedelta, timezone
 from types import SimpleNamespace
 
-from app.downloads.links import _GRANT_TTL, check_grant, is_expired, make_grant, new_token
+from app.downloads.links import (
+    _GRANT_TTL,
+    check_grant,
+    is_expired,
+    make_grant,
+    new_token,
+    public_meta,
+)
 
 
 def test_new_token_is_unguessable_and_unique():
@@ -48,6 +55,44 @@ class TestGrant:
             assert check_grant("tok", bad, 0) is False
 
 
+def _asset(**over):
+    base = dict(
+        title="Clip",
+        uploader="Someone",
+        uploader_url=None,
+        duration_s=42,
+        width=1280,
+        height=720,
+        vcodec="h264",
+        acodec="aac",
+        source_webpage_url=None,
+        source_kind="url",
+    )
+    base.update(over)
+    return SimpleNamespace(**base)
+
+
+class TestPublicMetaAudioFlag:
+    """The watch page picks <audio> vs <video> from this flag; WebKit refuses an audio-only mp3 in a
+    <video>, so an audio-only asset (codec present, no video stream) must report audio=True."""
+
+    _link = SimpleNamespace(allow_download=True)
+
+    def test_audio_only_asset_is_flagged_audio(self):
+        asset = _asset(vcodec=None, acodec="mp3", width=None, height=None)
+        meta = public_meta(self._link, None, asset, "/f.mp3")
+        assert meta["audio"] is True
+
+    def test_a_video_asset_is_not_audio(self):
+        meta = public_meta(self._link, None, _asset(), "/f.mp4")
+        assert meta["audio"] is False
+
+    def test_a_silent_video_is_not_audio(self):
+        # Video present but no audio track — still a video player, not the audio bar.
+        meta = public_meta(self._link, None, _asset(acodec=None), "/f.mp4")
+        assert meta["audio"] is False
+
+
 class TestIsExpired:
     def test_none_expiry_never_expires(self):
         assert is_expired(SimpleNamespace(expires_at=None)) is False