fix(downloads): harden automatic capture and aria2 transfers

- Pass prepared redirect URIs to Aria2 while preserving stable source identities.

- Fence effective-connection telemetry and retry lifecycle transitions by control epoch.

- Keep credentialed routes conservative across redirects, mirrors, and inline URL credentials.

- Preflight destination access and preserve actionable retryable permission errors in the UI.

- Add adversarial regression coverage for ranges, redirects, retries, telemetry, and enqueue failures.

src/components/AddDownloadsModal.tsx

@@ -1496,7 +1496,8 @@ export const AddDownloadsModal = () => {
                      lastError: undefined
                    }, pendingAction);
                    if (!replaced) {
-                     throw new Error(t($ => $.addDownloads.backendRejectedStart));
+                     const rejected = useDownloadStore.getState().downloads.find(download => download.id === existingItem.id);
+                     throw new Error(rejected?.lastError || t($ => $.addDownloads.backendRejectedStart));
                    }
 
                    // The existing row was updated in place; do not create a
@@ -1625,7 +1626,8 @@ export const AddDownloadsModal = () => {
           sizeBytes: item.sizeBytes
         }, action);
         if (!added) {
-          throw new Error(t($ => $.addDownloads.backendRejectedStart));
+          const rejected = useDownloadStore.getState().downloads.find(download => download.id === id);
+          throw new Error(rejected?.lastError || t($ => $.addDownloads.backendRejectedStart));
         }
         addedCount += 1;
         } catch (e) {