fix: prevent concurrent yt-dlp sessions that invalidate cookies

Three code paths could fire yt-dlp immediately (polite=False) while a
download was already running, causing YouTube to see two simultaneous
authenticated sessions and invalidate the cookie:

- search.py: live yt-dlp fallback now skipped while any download is active
- downloads.py: _ensure_video uses polite=True so it waits for active
  downloads to finish before fetching metadata for an unknown video
- channels.py: follow_by_url uses polite=True when fetching metadata
  for a brand-new channel

Added is_download_active() helper to ytdlp.py to expose the active
download state without importing private globals.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/routers/channels.py

@@ -1185,7 +1185,7 @@ def follow_by_url(
 
     channel = db.query(Channel).filter_by(youtube_channel_id=yt_channel_id).first()
     if not channel:
-        meta = ytdlp.fetch_channel_metadata(yt_channel_id, max_videos=30)
+        meta = ytdlp.fetch_channel_metadata(yt_channel_id, max_videos=30, polite=True)
         if not meta or not meta.get("channel"):
             raise HTTPException(status_code=404, detail="Channel not found on YouTube")
         ch_data = meta["channel"]