fix(downloads): harden automatic capture and aria2 transfers

- Pass prepared redirect URIs to Aria2 while preserving stable source identities.

- Fence effective-connection telemetry and retry lifecycle transitions by control epoch.

- Keep credentialed routes conservative across redirects, mirrors, and inline URL credentials.

- Preflight destination access and preserve actionable retryable permission errors in the UI.

- Add adversarial regression coverage for ranges, redirects, retries, telemetry, and enqueue failures.

src/components/AddDownloadsModal.tsx

@@ -1496,7 +1496,8 @@ export const AddDownloadsModal = () => {
                      lastError: undefined
                    }, pendingAction);
                    if (!replaced) {
-                     throw new Error(t($ => $.addDownloads.backendRejectedStart));
+                     const rejected = useDownloadStore.getState().downloads.find(download => download.id === existingItem.id);
+                     throw new Error(rejected?.lastError || t($ => $.addDownloads.backendRejectedStart));
                    }
 
                    // The existing row was updated in place; do not create a
@@ -1625,7 +1626,8 @@ export const AddDownloadsModal = () => {
           sizeBytes: item.sizeBytes
         }, action);
         if (!added) {
-          throw new Error(t($ => $.addDownloads.backendRejectedStart));
+          const rejected = useDownloadStore.getState().downloads.find(download => download.id === id);
+          throw new Error(rejected?.lastError || t($ => $.addDownloads.backendRejectedStart));
         }
         addedCount += 1;
         } catch (e) {

src/components/DownloadItem.tsx

@@ -334,7 +334,11 @@ export const DownloadItem = React.memo<DownloadItemProps>(({
             </div>
             <span
               title={
-                download.lastError && (download.status === 'failed' || download.status === 'retrying')
+                download.lastError && (
+                  download.status === 'failed'
+                  || download.status === 'retrying'
+                  || download.lastErrorKind === 'destinationAccess'
+                )
                   ? download.lastError
                   : (download.status === 'queued' || download.status === 'staged') && queueIndex !== -1
                   ? `${downloadStatusLabel} #${queueIndex + 1}`