fix(desktop): authenticate gated file downloads for password remotes

[686f6c61]

What does this PR do?

A remote gateway with auth_required: true is classified as oauth. File save/read then used only the OAuth session partition (persist:hermes-remote-oauth). Password-only (dashboard.basic_auth) logins set the session cookie via POST /auth/password-login, often in the default session — so /api/fs/download and /api/fs/read-data-url 401'd while a browser cookie request succeeded. Native bearer login had the same hole on the streaming download path.

Gated downloads and cookie REST now: prefer the native bearer, then the OAuth partition, then (password-only) the default session.

Related Issue

Fixes #88987

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Security fix
• Documentation update
• Tests (adding or improving test coverage)
• Refactor (no behavior change)
• New skill (bundled or hub)

Changes Made

• native-auth-decisions.ts: gatedCookieSessionOrder()
• main.ts: downloadGatedToFile / fetchJsonViaGatedCookies used by saveGatewayFile, hermes:api, and fetchJsonForBackend
• Tests for the cookie-jar order

Not runtime-tested against a live password-gated remote.

How to Test

cd apps/desktop
vitest run --project electron electron/native-auth-decisions.test.ts
# 15 passed

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Ubuntu Linux

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

N/A (no UI change)

[OutThisLife]

Superseded by #90546.

That salvage keeps the auth fix (gated downloads have to present credentials), rebased onto current main, and:

• reuses resolveOauthRestAuth via resolveGatedDownloadAuth — same bearer-then-cookie ladder as hermes:api
• drops the default-session cookie-jar walk and REST 401 retries
• covers the decision with a behavior test

You're credited via Co-authored-by. Thanks for tracing the password-remote 401.