refactor: the native downloaders share one download loop, file record and seen-ledger key; a clean walk marks its credential verified

Patreon, SubscribeStar and Discord each carried their own copy of the same
per-post download loop, file record and seen-ledger key, and every copy was
another place a fix could be missed.

- BaseNativeDownloader runs one post's files: the seen and on-disk skips,
  the mid-post time-box, pacing, validation and the per-file sidecar. Each
  platform overrides only where its layout differs: Discord's channel folder,
  file names and message-id sidecar, and Patreon's Mux video through yt-dlp.
- One MediaItem and one ledger_key in native_ingest_common replace the three
  per-client copies. Keys are unchanged, except that a SubscribeStar file with
  no gallery id is now keyed by its filename instead of an empty id.
- DownloadResult, ErrorType and the run-stats and tier-gated helpers move
  from gallery_dl.py, which now serves only HentaiFoundry, to
  download_result.py. The unused delegator methods on GalleryDLService go.
- The download lock's platform list is the native-ingester list, not a copy.
- A walk that used a credential and finished with no error type stamps that
  credential's last-verified time, so the credentials page shows when the
  account last worked. A tier-limited walk does not count: an expired session
  hides paid posts the same way.
- The extension no longer clears a retired pixiv token on startup.
- Two comments that still described every download as gallery-dl now name
  both backends.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extension/background/background.js

@@ -1,11 +1,6 @@
 /**
  * Background script — message router + Discord token capture (webRequest).
  * Direct port of GS background.js; api.js client points at FC instead of GS.
- *
- * pixiv's PKCE OAuth flow lived here until FC retired pixiv (milestone #406).
- * It was removed together with pixiv's host permissions rather than left
- * behind: a webRequest listener on a host the manifest no longer grants is at
- * best dead and at worst a startup failure for the whole background script.
  */
 
 let discordToken = null;
@@ -17,19 +12,9 @@ async function ensureInitialized() {
   if (initialized) return;
   await api.init();
   await loadDiscordToken();
-  await forgetRetiredPixivToken();
   initialized = true;
 }
 
-// A browser that authenticated pixiv before the retirement still holds a live
-// OAuth refresh token in extension storage. Nothing reads it any more, and a
-// credential for a service FC no longer uses is a liability with no benefit
-// (the same reasoning as the server-side cleanup, issue #3980). Removing keys
-// that are absent is a no-op, so this is safe on every startup.
-async function forgetRetiredPixivToken() {
-  await browser.storage.local.remove(['pixivRefreshToken', 'pixivTokenCapturedAt']);
-}
-
 browser.runtime.onInstalled.addListener(() => ensureInitialized());
 browser.runtime.onStartup.addListener(() => ensureInitialized());
 ensureInitialized().catch(e => console.error('init failed:', e));