Add Phase B: cookies, aria2c, proxy/rate-limit, restrict-filenames & archive

Implements the remaining Phase B (Access & networking) items from
ROADMAP.md: cookie sources (browser cookie-store import, or a built-in
sign-in window that exports a Netscape cookie file via a persisted Electron
session partition), the aria2c external downloader, proxy/rate-limit,
restrict-filenames, and a download-archive to skip repeats.

Wires download.ts to the buildArgs() module added in the previous commit
(it wasn't hooked up yet) and renames its options param
NetworkOptions -> AccessOptions to reflect the wider scope now that cookies
and filename/archive flags joined proxy/rate-limit/aria2c.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/preload/index.ts

@@ -7,7 +7,9 @@ import {
   type StartDownloadResult,
   type DownloadEvent,
   type Settings,
-  type HistoryEntry
+  type HistoryEntry,
+  type CookiesStatus,
+  type CookiesLoginResult
 } from '@shared/ipc'
 
 // The surface exposed to the renderer. Keep this thin: it only forwards to IPC.
@@ -49,6 +51,14 @@ const api = {
 
   clearHistory: (): Promise<HistoryEntry[]> => ipcRenderer.invoke(IpcChannels.historyClear),
 
+  /** Open the built-in sign-in window; resolves once the user closes it. */
+  cookiesLogin: (url: string): Promise<CookiesLoginResult> =>
+    ipcRenderer.invoke(IpcChannels.cookiesLogin, url),
+
+  cookiesStatus: (): Promise<CookiesStatus> => ipcRenderer.invoke(IpcChannels.cookiesStatus),
+
+  cookiesClear: (): Promise<void> => ipcRenderer.invoke(IpcChannels.cookiesClear),
+
   /** Subscribe to live download events. Returns an unsubscribe function. */
   onDownloadEvent: (cb: (ev: DownloadEvent) => void): (() => void) => {
     const listener = (_e: IpcRendererEvent, ev: DownloadEvent): void => cb(ev)