feat: sign in to YouTube with browser cookies

Answers the bot challenge from inside the app. Settings gains a browser
picker listing only the browsers actually installed; choosing one passes
--cookies-from-browser to every yt-dlp call, so YouTube sees an
authenticated session. Verified against a live block: refused without
cookies, resolved with them.

Arc is Chromium underneath but is not one of yt-dlp's known names, so it
is addressed by its profile directory instead.

yt-dlp's errors are translated into something actionable. The stock bot
message points at command-line flags a user cannot type; it now names
the setting that fixes it, and Safari's protected cookie store gets its
own message about Full Disk Access rather than a bare 'Operation not
permitted'.

A Check connection button reports whether YouTube is reachable, testing
against the newest video in the feed — the hardcoded id it used at first
had been taken down, so it reported a dead video rather than the
connection.

src/api.ts

@@ -32,6 +32,16 @@ export const deleteAllDownloads = () => invoke<number>("delete_all_downloads");
 /** Fills in missing video lengths, a batch at a time. Returns how many. */
 export const fetchDurations = () => invoke<number>("fetch_durations");
 
+/** Browsers installed here that yt-dlp can read cookies from: [id, label]. */
+export const listBrowsers = () => invoke<Array<[string, string]>>("list_browsers");
+
+/** Empty string signs out. */
+export const setCookieSource = (browser: string) =>
+  invoke<void>("set_cookie_source", { browser });
+
+/** Resolves a known video to check whether YouTube is currently reachable. */
+export const testYoutube = () => invoke<string>("test_youtube");
+
 /** WebVTT sidecars beside a downloaded video, as [language, path] pairs. */
 export const listSubtitles = (videoId: string) =>
   invoke<Array<[string, string]>>("list_subtitles", { videoId });