fix: prevent concurrent yt-dlp sessions that invalidate cookies

Three code paths could fire yt-dlp immediately (polite=False) while a
download was already running, causing YouTube to see two simultaneous
authenticated sessions and invalidate the cookie:

- search.py: live yt-dlp fallback now skipped while any download is active
- downloads.py: _ensure_video uses polite=True so it waits for active
  downloads to finish before fetching metadata for an unknown video
- channels.py: follow_by_url uses polite=True when fetching metadata
  for a brand-new channel

Added is_download_active() helper to ytdlp.py to expose the active
download state without importing private globals.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/services/ytdlp.py

@@ -84,6 +84,11 @@ def _meta_run(args: list[str], timeout: int = 60) -> tuple[str, str, int]:
             _meta_last_call = time.monotonic()
 
 
+def is_download_active() -> bool:
+    with _active_downloads_lock:
+        return _active_downloads > 0
+
+
 def _parse_date(date_str: str | None) -> datetime | None:
     if not date_str:
         return None