fix(downloads): harden automatic capture and aria2 transfers

- Pass prepared redirect URIs to Aria2 while preserving stable source identities.

- Fence effective-connection telemetry and retry lifecycle transitions by control epoch.

- Keep credentialed routes conservative across redirects, mirrors, and inline URL credentials.

- Preflight destination access and preserve actionable retryable permission errors in the UI.

- Add adversarial regression coverage for ranges, redirects, retries, telemetry, and enqueue failures.

src/components/DownloadItem.tsx

@@ -334,7 +334,11 @@ export const DownloadItem = React.memo<DownloadItemProps>(({
             </div>
             <span
               title={
-                download.lastError && (download.status === 'failed' || download.status === 'retrying')
+                download.lastError && (
+                  download.status === 'failed'
+                  || download.status === 'retrying'
+                  || download.lastErrorKind === 'destinationAccess'
+                )
                   ? download.lastError
                   : (download.status === 'queued' || download.status === 'staged') && queueIndex !== -1
                   ? `${downloadStatusLabel} #${queueIndex + 1}`