[tahadx]

What

• Treat a filename= query parameter as a file URL, so an HTML sign-in answer to /download?filename=report.docx is explained instead of recorded as 400 Bad Request.
• Name a redirect that ends at accounts.google.com as a sign-in wall. catch why now points at the browser session instead of suggesting a resume that can never authenticate.
• Derive the row name from filename= when the path has no extension, so the row and saved file keep their .docx/.zip name.
• Leave Gemini, Docs, Drive, and Gmail downloads to the browser in both extensions. Catch has no cookies, so taking these over cancels the only request that can succeed.

Tests

• cargo test -p catch — 63 unit + 42 reliability tests
• cargo clippy -p catch --all-targets -- -D warnings
• node --check both extension scripts; cmp confirms they are identical
• bin/check-release, bin/lint-qml, tests/install.test.sh
• Manual check with a real account-bound Gemini link: the row now reports sign-in required — this link needs the browser's account session... and keeps its .docx filename.

Try it

git fetch origin fix/signin-wall
git checkout fix/signin-wall
bin/refresh-dist

Then retry an account-bound Google link (or catch why <id> on the existing failed row). It should no longer say 400 Bad Request; it should say sign-in required and tell you to download it with the browser. New Gemini/Docs/Drive/Gmail downloads will stay in the browser instead of being intercepted.