fix: prevent concurrent yt-dlp sessions that invalidate cookies

Three code paths could fire yt-dlp immediately (polite=False) while a
download was already running, causing YouTube to see two simultaneous
authenticated sessions and invalidate the cookie:

- search.py: live yt-dlp fallback now skipped while any download is active
- downloads.py: _ensure_video uses polite=True so it waits for active
  downloads to finish before fetching metadata for an unknown video
- channels.py: follow_by_url uses polite=True when fetching metadata
  for a brand-new channel

Added is_download_active() helper to ytdlp.py to expose the active
download state without importing private globals.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/routers/search.py

@@ -264,8 +264,9 @@ def search(
 
     source = "local" if (video_results or channel_results) else "none"
 
-    # Fall back to live yt-dlp search if no local results or explicitly requested
-    if not video_results or live:
+    # Fall back to live yt-dlp search if no local results or explicitly requested.
+    # Skip if a download is active — concurrent yt-dlp sessions invalidate cookies.
+    if (not video_results or live) and not ytdlp.is_download_active():
         try:
             live_raw = ytdlp.search_youtube(q)
             live_results = _live_search_to_results(db, current_user.id, live_raw)