refactor(download): rename Want/Request to Request/Download, unify downloads flow, add auto-download guardrails

The durable "I asked for this" record was called Want, and the one-shot
search-and-grab attempt was called Request — names that didn't match
what either actually did. Want is now Request, and the old Request/Item
is now Download/DownloadItem, with a table-rename migration
(download_wants -> download_requests, old download_requests ->
download_downloads) safe against both fresh installs and existing data.

Every anchored manual download now upserts/reuses a durable Request
before running, so a "download now" that finds nothing is picked up by
the background reconciler automatically instead of just failing with
no trace — the gap that caused this session's repeated "no candidates
found" failures on the same album.

Also adds auto-download guardrails (file-size min/max with a preferred
target, allowed file types) that gate what the pipeline may grab
unattended, live-editable from a new settings section. The frontend's
wanted-view becomes downloads-view, with a new Downloads tab showing
attempt/transfer history that previously had no UI at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y2Agd9af5hE7qzti2ackiS

backend/download/fake.go

@@ -92,7 +92,7 @@ func (f *FakeProvider) Close() error {
 // Search returns the configured candidates.
 func (f *FakeProvider) Search(
 	ctx context.Context,
-	_ Request,
+	_ Download,
 ) ([]Candidate, error) {
 	f.mu.Lock()
 	f.SearchCalls++
@@ -208,7 +208,7 @@ var errNoDelegateStatus = errors.New("fake: no delegate status configured")
 // Delegate records the call and returns a fixed external ID.
 func (f *FakeProvider) Delegate(
 	_ context.Context,
-	_ Request,
+	_ Download,
 ) (string, error) {
 	f.mu.Lock()
 	defer f.mu.Unlock()