fix: harden media handoff and live logs

Reject stale extension media cookie headers before yt-dlp metadata work, preserve ordinary capture cookies, and advance the companion extension.

Stream redacted diagnostic logs only while the visible Logs view is active, with bounded batched updates and race-safe snapshot handoff.

src/store/useDownloadStore.test.ts

@@ -819,7 +819,7 @@ describe('useDownloadStore', () => {
       silent: false,
       filename: null,
       headers: 'User-Agent: Firefox Test',
-      cookies: 'session=secret',
+      cookies: `oversized=${'x'.repeat(64 * 1024)}`,
       media: true
     });
 
@@ -827,7 +827,21 @@ describe('useDownloadStore', () => {
     expect(state.isAddModalOpen).toBe(true);
     expect(state.pendingAddUrls).toBe('https://adult.example/watch/123');
     expect(state.pendingAddMediaUrls).toEqual(['https://adult.example/watch/123']);
-    expect(state.pendingAddCookies).toBe('session=secret');
+    expect(state.pendingAddCookies).toBe('');
+  });
+
+  it('preserves extension cookies for ordinary captured downloads', async () => {
+    await useDownloadStore.getState().handleExtensionDownload({
+      urls: ['https://example.com/private.zip'],
+      referer: 'https://example.com/downloads',
+      silent: true,
+      filename: 'private.zip',
+      headers: null,
+      cookies: 'session=secret',
+      media: false
+    });
+
+    expect(useDownloadStore.getState().pendingAddCookies).toBe('session=secret');
   });
 
   it('clears stale request context when the same URL is captured without it later', async () => {

src/store/useDownloadStore.ts

@@ -551,12 +551,17 @@ export const useDownloadStore = create<DownloadState>((set, get) => ({
     const urls = [...new Set(request.urls.map(url => url.trim()).filter(Boolean))];
     if (urls.length === 0) return;
 
+    // Explicit media authentication belongs to yt-dlp's configured browser
+    // cookie source. Keep this frontend guard for events from older desktop or
+    // extension builds; ordinary captured downloads retain their cookies.
+    const cookies = request.media === true ? null : request.cookies;
+
     get().openAddModalWithUrls(
       urls.join('\n'),
       request.referer,
       urls.length === 1 ? request.filename : null,
       request.headers,
-      request.cookies,
+      cookies,
       request.media === true
     );
   },