fix: a YouTube stream refused after extraction is the gate, not a network fault

Measured on the isolated test stack the same night, on the very same video ~90 minutes after it was
answering with the bot message: yt-dlp got the player response and picked its formats, and the CDN
then refused the stream itself — "unable to download video data: HTTP Error 403: Forbidden".
Signed out it did that on every attempt; with the owner's cookie attached the video downloaded in
full. So the wall moves between the player response and the stream, and the text it wears there was
costing the download twice.

retriable: the format URLs belong to the client that minted them, so the next client set is a real
second chance — but this text classifies as `network` and nothing in the YouTube marker list matched
it, so the ladder ended the job on attempt 1 and never tried the fallback.

catalog: `youtube.media_forbidden` for the cookie-less case, so the UI stops calling it a network
error when nothing was wrong with the network, and names what actually gets past it. Scoped exactly
as narrowly as the measurement: another host keeps the generic `network` category, and so does a
download that already carried a cookie — telling a signed-in user to sign in is the failure the
catalog exists to avoid. EN + HU copy.

backend/tests/test_download_errors.py

@@ -119,6 +119,29 @@ def test_youtube_bot_wall_with_a_cookie_is_the_cookie_refused():
     )
 
 
+# Verbatim from the isolated test stack (2026-09-16), the SAME video ~90 minutes later: yt-dlp got
+# the player response and picked formats, and the CDN then refused the stream.
+_YT_MEDIA_403 = "ERROR: unable to download video data: HTTP Error 403: Forbidden"
+
+
+def test_youtube_media_403_is_the_wall_one_step_later_not_a_network_fault():
+    # Generically this text is a network failure — and for every other host it stays one.
+    assert classify(_YT_MEDIA_403) == "network"
+    assert dlerrors.diagnose(_YT_MEDIA_403, url="https://vimeo.com/1") == ("network", None)
+    # On a signed-out YouTube download it is the gate: measured, the same video downloaded in full
+    # once the owner's cookie was attached. Calling that "network error" is the honest-states bug.
+    assert dlerrors.diagnose(_YT_MEDIA_403, url=_YT) == (
+        "login_required",
+        "youtube.media_forbidden",
+    )
+
+
+def test_youtube_media_403_with_a_cookie_is_not_claimed_as_the_gate():
+    # Only the cookie-less case was measured. With a cookie the same text keeps its bare category
+    # rather than telling a signed-in user to sign in.
+    assert dlerrors.diagnose(_YT_MEDIA_403, url=_YT, cookie_attached=True) == ("network", None)
+
+
 def test_the_youtube_entries_never_match_another_site():
     # Host-scoped: the same words about a Facebook link stay the bare category.
     assert dlerrors.diagnose(