feat(downloads): per-user, per-host yt-dlp cookie/auth support (S6)

Each user stores their own login cookies (Netscape cookies.txt) for an
auth-walled download host (Facebook, Instagram, X, TikTok, Reddit) in
Settings; a download of an auth-walled link on that host is retried with
the acting user's cookie.

Two load-bearing security controls, both in downloads.credentials as the
single source of truth so enqueue and the worker can't drift:
- cache privacy: a cookie-authed download salts its MediaAsset format_sig
  with the user id, so the authed asset is private and never cache-served
  to another user. The worker attaches a cookie ONLY when the asset it is
  downloading into IS that private, salted identity.
- host scope (SEC-12): a cookie is resolved only for a URL whose netloc
  the credential owns (netloc-scoped _host_is); a look-alike/unrelated
  host gets none.

cookies_enc is Fernet-encrypted at rest, only decrypted in-worker into a
0600 file under staging/.auth/ (survives the retry wipe + _produced_file
scan) and unlinked in finally. The blob is never returned by a route,
logged, audited, or written to a job's error/snapshot. cookiefile is set
after the adapter's extra merge so an adapter can't clobber it. Settings
UI is write-only (host + set/updated only, never echoed). New
download_credentials table + migration 0074; per-user routes; HU+EN i18n.

Tests: host-scope, cache-privacy (no cross-user serve), encrypt-at-rest,
write-only API, worker attach-gate; FE dom test for the write-only field.

backend/app/routes/downloads.py

@@ -16,10 +16,11 @@ from pydantic import BaseModel
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
-from app import sysconfig
+from app import audit, sysconfig
 from app.auth import admin_user, require_human
 from app.config import settings
 from app.db import get_db
+from app.downloads import credentials as dlcreds
 from app.downloads import edit as editmod
 from app.downloads import links as linksmod
 from app.downloads import quota, service, storage
@@ -247,6 +248,65 @@ def delete_profile(
     return {"deleted": profile_id}
 
 
+# --- per-user download auth (cookies) ------------------------------------------------------
+# Write-only surface: the stored blob is NEVER returned — only the supported hosts + whether each
+# is configured + when. See downloads.credentials for the host-scope + cache-privacy guarantees.
+
+
+@router.get("/credentials")
+def list_credentials(user: User = Depends(require_human), db: Session = Depends(get_db)) -> dict:
+    return {"hosts": dlcreds.status_list(db, user.id)}
+
+
+class SetCredentialIn(BaseModel):
+    cookies: str
+
+
+@router.put("/credentials/{host_key}")
+def set_credential(
+    host_key: str,
+    body: SetCredentialIn,
+    user: User = Depends(require_human),
+    db: Session = Depends(get_db),
+) -> dict:
+    """Store (encrypted) this user's cookies.txt for one supported host. Write-only: the value is
+    never echoed back, logged, or audited — only the fact that it changed."""
+    if not dlcreds.is_supported_host(host_key):
+        raise HTTPException(status_code=404, detail="Unknown host")
+    try:
+        cleaned = dlcreds.validate_cookies(body.cookies)
+    except dlcreds.InvalidCookies as e:
+        raise HTTPException(status_code=400, detail={"code": "cookies", "reason": str(e)})
+    dlcreds.upsert_credential(db, user.id, host_key, cleaned)
+    audit.record(
+        db,
+        user.id,
+        audit.AuditAction.DOWNLOAD_CREDENTIAL_SET,
+        target_type="download_credential",
+        target_id=host_key,
+    )
+    db.commit()
+    return {"ok": True, "hosts": dlcreds.status_list(db, user.id)}
+
+
+@router.delete("/credentials/{host_key}")
+def delete_credential(
+    host_key: str, user: User = Depends(require_human), db: Session = Depends(get_db)
+) -> dict:
+    if not dlcreds.is_supported_host(host_key):
+        raise HTTPException(status_code=404, detail="Unknown host")
+    if dlcreds.delete_credential(db, user.id, host_key):
+        audit.record(
+            db,
+            user.id,
+            audit.AuditAction.DOWNLOAD_CREDENTIAL_DELETE,
+            target_type="download_credential",
+            target_id=host_key,
+        )
+    db.commit()
+    return {"ok": True, "hosts": dlcreds.status_list(db, user.id)}
+
+
 def _resolve_spec(
     db: Session, user: User, profile_id: int | None, spec: dict | None
 ) -> tuple[dict, int | None]: