feat(downloads): editable details with clickable channel and extra links

The edit (pencil) action now edits a download's full display metadata — title,
channel name, channel link and any number of extra reference URLs — instead of
just the name. The channel and links render as clickable links on the library
card, and the channel link is auto-filled from the source (yt-dlp channel_url)
when available. Shared watch pages resolve the same per-download overrides, so a
rename/channel/link edit is reflected on the public /watch page too, with every
link clickable.

Adds migration 0049 (media_assets.uploader_url; download_jobs.display_uploader,
display_uploader_url, extra_links) and generalizes the rename endpoint into a
metadata update with URL validation. EN/HU/DE strings included.

backend/app/routes/downloads.py

@@ -100,6 +100,9 @@ def _serialize(job: DownloadJob, asset: MediaAsset | None) -> dict:
         "profile_id": job.profile_id,
         "spec": job.profile_snapshot,
         "display_name": job.display_name,
+        "display_uploader": job.display_uploader,
+        "display_uploader_url": job.display_uploader_url,
+        "extra_links": job.extra_links or [],
         "job_kind": job.job_kind,
         "source_job_id": job.source_job_id,
         "edit_spec": job.edit_spec,
@@ -118,6 +121,7 @@ def _serialize(job: DownloadJob, asset: MediaAsset | None) -> dict:
             "width": asset.width,
             "height": asset.height,
             "container": asset.container,
+            "uploader_url": asset.uploader_url,
             "thumbnail_url": asset.thumbnail_url,
             "expires_at": asset.expires_at.isoformat() if asset.expires_at else None,
         },
@@ -380,17 +384,47 @@ def shared_with_me(
     return out
 
 
+_MAX_EXTRA_LINKS = 8
+
+
+def _clean_url(raw) -> str | None:
+    """Accept only a plausible http(s) URL (these get rendered as clickable links + embedded in a
+    public watch page); anything else is dropped rather than trusted."""
+    if not isinstance(raw, str):
+        return None
+    url = raw.strip()
+    if not url:
+        return None
+    if not url.startswith(("http://", "https://")):
+        return None
+    parsed = urlparse(url)
+    if not parsed.netloc:
+        return None
+    return url[:2048]
+
+
 @router.patch("/{job_id}")
-def rename_download(
+def update_download_meta(
     job_id: int,
     payload: dict,
     user: User = Depends(require_human),
     db: Session = Depends(get_db),
 ) -> dict:
+    """Update a download's display metadata: title, channel name + link, and extra reference URLs.
+    All are display-only overrides — the on-disk file keeps its system-decided, id-bound name."""
     job = _own_job(db, user, job_id)
-    name = (payload.get("display_name") or "").strip()
-    # Display name only — the on-disk file keeps its system-decided, id-bound name.
-    job.display_name = name[:255] or None
+    if "display_name" in payload:
+        job.display_name = ((payload.get("display_name") or "").strip())[:255] or None
+    if "display_uploader" in payload:
+        job.display_uploader = ((payload.get("display_uploader") or "").strip())[:255] or None
+    if "display_uploader_url" in payload:
+        job.display_uploader_url = _clean_url(payload.get("display_uploader_url"))
+    if "extra_links" in payload:
+        raw = payload.get("extra_links") or []
+        if not isinstance(raw, list):
+            raise HTTPException(status_code=400, detail="extra_links must be a list")
+        cleaned = [u for u in (_clean_url(x) for x in raw) if u][:_MAX_EXTRA_LINKS]
+        job.extra_links = cleaned or None
     db.commit()
     asset = db.get(MediaAsset, job.asset_id) if job.asset_id else None
     return _serialize(job, asset)