fix(downloads): harden release-critical transfer paths

src/store/useDownloadStore.test.ts

@@ -845,7 +845,7 @@ describe('useDownloadStore', () => {
       referer: 'https://adult.example/watch/123',
       silent: false,
       filename: null,
-      headers: 'User-Agent: Firefox Test',
+      headers: `Cookie: stale=${'x'.repeat(64 * 1024)}\nUser-Agent: Firefox Test`,
       cookies: `oversized=${'x'.repeat(64 * 1024)}`,
       media: true
     });
@@ -855,6 +855,7 @@ describe('useDownloadStore', () => {
     expect(state.pendingAddUrls).toBe('https://adult.example/watch/123');
     expect(state.pendingAddMediaUrls).toEqual(['https://adult.example/watch/123']);
     expect(state.pendingAddCookies).toBe('');
+    expect(state.pendingAddHeaders).toBe('User-Agent: Firefox Test');
   });
 
   it('preserves extension cookies for ordinary captured downloads', async () => {

src/store/useDownloadStore.ts

@@ -67,6 +67,16 @@ const removeStaleBackendDispatch = async (id: string): Promise<void> => {
 const errorMessage = (error: unknown): string =>
   error instanceof Error ? error.message : String(error);
 
+const stripCookieHeaders = (value: string | null | undefined): string =>
+  (value || '')
+    .split(/\r?\n/)
+    .filter(line => {
+      const separator = line.indexOf(':');
+      return separator < 0 || line.slice(0, separator).trim().toLowerCase() !== 'cookie';
+    })
+    .join('\n')
+    .trim();
+
 const speedLimitForDispatch = (itemSpeedLimit: string | undefined, globalSpeedLimit: string): string | null => {
   const explicitLimit = itemSpeedLimit?.trim();
   if (explicitLimit) {
@@ -558,12 +568,15 @@ export const useDownloadStore = create<DownloadState>((set, get) => ({
     // cookie source. Keep this frontend guard for events from older desktop or
     // extension builds; ordinary captured downloads retain their cookies.
     const cookies = request.media === true ? null : request.cookies;
+    const headers = request.media === true
+      ? stripCookieHeaders(request.headers) || null
+      : request.headers;
 
     get().openAddModalWithUrls(
       urls.join('\n'),
       request.referer,
       urls.length === 1 ? request.filename : null,
-      request.headers,
+      headers,
       cookies,
       request.media === true
     );