Add Phase B: cookies, aria2c, proxy/rate-limit, restrict-filenames & archive

Implements the remaining Phase B (Access & networking) items from
ROADMAP.md: cookie sources (browser cookie-store import, or a built-in
sign-in window that exports a Netscape cookie file via a persisted Electron
session partition), the aria2c external downloader, proxy/rate-limit,
restrict-filenames, and a download-archive to skip repeats.

Wires download.ts to the buildArgs() module added in the previous commit
(it wasn't hooked up yet) and renames its options param
NetworkOptions -> AccessOptions to reflect the wider scope now that cookies
and filename/archive flags joined proxy/rate-limit/aria2c.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test/real-download.integration.test.ts

@@ -21,6 +21,7 @@ const RUN = process.env.AEROFETCH_REAL_DOWNLOAD === '1'
 const BIN_DIR = resolve('resources/bin')
 const YTDLP = join(BIN_DIR, 'yt-dlp.exe')
 const FFMPEG = join(BIN_DIR, 'ffmpeg.exe')
+const NO_ACCESS = { proxy: '', rateLimit: '', restrictFilenames: false }
 
 interface RunResult {
   status: number | null
@@ -105,7 +106,7 @@ describe.skipIf(!RUN)('real yt-dlp downloads (buildArgs end-to-end)', () => {
         embedThumbnail: true,
         cropThumbnail: true
       }
-      const argv = buildArgs(opts, join(outDir, '%(id)s.%(ext)s'), options, BIN_DIR)
+      const argv = buildArgs(opts, join(outDir, '%(id)s.%(ext)s'), options, BIN_DIR, NO_ACCESS)
       console.log('[crop] argv:', JSON.stringify(argv))
 
       const res = runYtdlp(argv)
@@ -146,7 +147,7 @@ describe.skipIf(!RUN)('real yt-dlp downloads (buildArgs end-to-end)', () => {
         sponsorBlockMode: 'remove' as const,
         sponsorBlockCategories: ['music_offtopic' as const]
       }
-      const argv = buildArgs(opts, join(outDir, '%(id)s.%(ext)s'), options, BIN_DIR)
+      const argv = buildArgs(opts, join(outDir, '%(id)s.%(ext)s'), options, BIN_DIR, NO_ACCESS)
       console.log('[sb] argv:', JSON.stringify(argv))
 
       const res = runYtdlp(argv)