Add Phase B: cookies, aria2c, proxy/rate-limit, restrict-filenames & archive

Implements the remaining Phase B (Access & networking) items from
ROADMAP.md: cookie sources (browser cookie-store import, or a built-in
sign-in window that exports a Netscape cookie file via a persisted Electron
session partition), the aria2c external downloader, proxy/rate-limit,
restrict-filenames, and a download-archive to skip repeats.

Wires download.ts to the buildArgs() module added in the previous commit
(it wasn't hooked up yet) and renames its options param
NetworkOptions -> AccessOptions to reflect the wider scope now that cookies
and filename/archive flags joined proxy/rate-limit/aria2c.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ROADMAP.md

@@ -51,16 +51,38 @@ typecheck, not yet by live yt-dlp downloads — worth a real-download smoke test
       persisted defaults; "Reset to defaults" clears it. Threads `options` through
       `addFromUrl → DownloadItem → startDownload` and is carried on retry.
 
-## Phase B — Access & networking
+## Phase B — Access & networking ✅ COMPLETE
 
-- [ ] **Cookies.** `--cookies-from-browser <chrome|edge|firefox…>` (easy Windows win) **and**
-      a built-in login window (Electron `BrowserWindow` + session cookie export →
-      `--cookies file.txt`) — Seal's WebView cookie feature, fully doable in Electron.
-- [ ] **aria2c external downloader.** Bundle `aria2c.exe`, `--downloader aria2c
-      --downloader-args`, toggle in settings.
-- [ ] **Proxy** (`--proxy`) and **rate limit** (`--limit-rate`).
-- [ ] **Restrict filenames** toggle (`--restrict-filenames`) + optional **download archive**
-      (`--download-archive`, skip already-downloaded).
+`buildArgs`'s former `NetworkOptions` param is now `AccessOptions` (still in
+`src/main/buildArgs.ts`) — it grew past pure networking once cookies and
+filename/archive flags joined proxy/rate-limit/aria2c. *Caveat: the sign-in
+window's cookie export is implemented per the Electron session-cookie and
+Netscape cookie-jar formats and verified by reasoning + typecheck, not yet by
+an actual live login → yt-dlp download against a gated video — worth a real
+smoke test.*
+
+- [x] **Cookies.** Settings → Cookies has a source picker:
+      - *From a browser's cookie store* → `--cookies-from-browser <name>` (chrome/edge/
+        firefox/brave/opera/vivaldi — `COOKIE_BROWSERS` in `src/shared/ipc.ts`).
+      - *Sign-in window (built into AeroFetch)* → opens an Electron `BrowserWindow` on a
+        persisted session partition (`persist:aerofetch-login`, see `src/main/cookies.ts`);
+        OAuth/SSO popups are allowed through onto the same partition. Closing the window
+        exports its cookies to a Netscape-format file (`userData/cookies.txt`) which
+        `buildArgs` passes via `--cookies`. Settings → Cookies shows last-saved time + a
+        "Clear saved cookies" button (also clears the partition's storage).
+- [x] **aria2c external downloader.** Settings → Network has a "Use aria2c downloader"
+      toggle; when on and `resources/bin/aria2c.exe` exists, `buildArgs` emits
+      `--downloader <path> --downloader-args` (`ARIA2C_ARGS` in `src/main/buildArgs.ts`:
+      `-x 16 -s 16 -k 1M`). Missing binary falls back silently to yt-dlp's own downloader
+      (checked in `src/main/download.ts`). Binary is optional and not committed — see
+      `resources/bin/README.md`.
+- [x] **Proxy** (`--proxy`) and **rate limit** (`--limit-rate`). Settings → Network fields
+      (`Settings.proxy` / `Settings.rateLimit`), threaded through `buildArgs`'s
+      `AccessOptions` param.
+- [x] **Restrict filenames** toggle (`--restrict-filenames`) + **download archive**
+      (`--download-archive`, skip already-downloaded) — both in Settings → Filenames.
+      The archive file lives at a fixed `userData/download-archive.txt`
+      (`getDownloadArchivePath()` in `src/main/settings.ts`), not user-configurable.
 
 ## Phase C — Custom commands & yt-dlp management