fix: pass capture cookies and headers securely to metadata fetcher

- Pass captured cookies and headers from UI state into the backend `fetch_metadata` command.
- Implement secure domain-matching redirect policy in the backend to prevent leaking cookies, headers, and Basic Auth credentials to third-party domains upon redirect.
- Ensure metadata fetches correctly identify authenticated files (e.g. from Gofile) without being redirected to login/error pages.

src/components/AddDownloadsModal.tsx

@@ -247,7 +247,9 @@ export const AddDownloadsModal = () => {
               url: row.sourceUrl,
               userAgent: settingsStore.customUserAgent || null,
               username: useAuth ? username.trim() || null : login?.username || null,
-              password: useAuth ? password || null : keychainPassword
+              password: useAuth ? password || null : keychainPassword,
+              headers: headers?.trim() || null,
+              cookies: cookies?.trim() || null
             });
             setParsedItems(current => updateRowIfCurrent(
               current,
@@ -291,7 +293,7 @@ export const AddDownloadsModal = () => {
         }
       })();
     }
-  }, [parsedItems, pendingAddFilename, password, useAuth, username]);
+  }, [parsedItems, pendingAddFilename, password, useAuth, username, headers, cookies]);
 
   useEffect(() => {
     if (parsedItems.length === 0) {