Add delete-downloaded-video and real YouTube unsubscribe

Delete local copy:
- MeTubeClient.delete_download() -> POST /delete {ids, where: "done"}
- Only ever acts on a job our own app tracked (metube_job_id we stored from
  its own 'completed' event), never a pre-existing MeTube file
- New "deleted" terminal status; DELETE /api/videos/{id}/download
- Frontend: delete button next to "На сервере" badge, confirm dialog

Unsubscribe (deliberate deviation from the original TZ's MVP exclusion of
subscription management, per explicit user request after being shown the
tradeoff):
- OAuth scope widened from youtube.readonly to full youtube (read/write) --
  existing stored tokens only cover the old scope, so unsubscribing needs a
  fresh reconnect; reads keep working unchanged on the old token meanwhile
- channels.youtube_subscription_id (distinct from the channel id; that's
  what subscriptions.delete actually keys on) captured during subscriptions
  sync
- YouTubeInsufficientScope raised on 401/403 "insufficient authentication
  scopes" and surfaced as a clear 403 asking the user to reconnect, rather
  than a generic API error
- POST /api/channels/{id}/unsubscribe calls subscriptions.delete and marks
  the channel unsubscribed locally on success
- Frontend: "Отписаться" button on ChannelCard with confirm dialog

10 new backend tests (73 total).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_channels.py

@@ -0,0 +1,88 @@
+import pytest
+from fastapi.testclient import TestClient
+
+from app.core.auth_dependency import require_session
+from app.db import get_db
+from app.main import app
+from app.models.channel import Channel
+from app.services import sync
+from app.services.youtube_client import YouTubeInsufficientScope
+
+
+@pytest.fixture
+def client(db_session):
+    def _get_db_override():
+        yield db_session
+
+    app.dependency_overrides[get_db] = _get_db_override
+    app.dependency_overrides[require_session] = lambda: None
+    # Deliberately not using `with TestClient(app)`: that runs the app's
+    # lifespan, which would try to reach the real MeTube instance and DB.
+    yield TestClient(app)
+    del app.dependency_overrides[get_db]
+    del app.dependency_overrides[require_session]
+
+
+def _seed_channel(db_session, youtube_subscription_id="sub1"):
+    channel = Channel(
+        youtube_channel_id="chanA",
+        youtube_subscription_id=youtube_subscription_id,
+        title="Channel A",
+        subscribed=True,
+    )
+    db_session.add(channel)
+    db_session.commit()
+    db_session.refresh(channel)
+    return channel
+
+
+def test_unsubscribe_success(client, db_session, monkeypatch):
+    channel = _seed_channel(db_session)
+
+    monkeypatch.setattr(sync.google_oauth, "get_credentials", lambda db: object())
+    calls = {}
+    monkeypatch.setattr(
+        sync.youtube_client,
+        "unsubscribe",
+        lambda creds, sub_id: calls.setdefault("sub_id", sub_id),
+    )
+
+    resp = client.post(f"/api/channels/{channel.id}/unsubscribe")
+
+    assert resp.status_code == 200
+    assert resp.json()["subscribed"] is False
+    assert calls["sub_id"] == "sub1"
+
+    db_session.refresh(channel)
+    assert channel.subscribed is False
+
+
+def test_unsubscribe_without_subscription_id_returns_400(client, db_session):
+    channel = _seed_channel(db_session, youtube_subscription_id=None)
+
+    resp = client.post(f"/api/channels/{channel.id}/unsubscribe")
+
+    assert resp.status_code == 400
+
+
+def test_unsubscribe_insufficient_scope_returns_403(client, db_session, monkeypatch):
+    channel = _seed_channel(db_session)
+
+    monkeypatch.setattr(sync.google_oauth, "get_credentials", lambda db: object())
+
+    def raise_insufficient(creds, sub_id):
+        raise YouTubeInsufficientScope("Request had insufficient authentication scopes.")
+
+    monkeypatch.setattr(sync.youtube_client, "unsubscribe", raise_insufficient)
+
+    resp = client.post(f"/api/channels/{channel.id}/unsubscribe")
+
+    assert resp.status_code == 403
+
+    db_session.refresh(channel)
+    assert channel.subscribed is True
+
+
+def test_unsubscribe_channel_not_found(client):
+    resp = client.post("/api/channels/9999/unsubscribe")
+    assert resp.status_code == 404

tests/test_sync.py

@@ -13,8 +13,20 @@ def test_sync_subscriptions_idempotent_and_unsubscribes(monkeypatch, db_session)
         sync.youtube_client,
         "fetch_subscriptions",
         lambda creds: [
-            {"youtube_channel_id": "chanA", "title": "Channel A", "description": "d", "thumbnail_url": "t"},
-            {"youtube_channel_id": "chanB", "title": "Channel B", "description": "d", "thumbnail_url": "t"},
+            {
+                "youtube_channel_id": "chanA",
+                "youtube_subscription_id": "subA",
+                "title": "Channel A",
+                "description": "d",
+                "thumbnail_url": "t",
+            },
+            {
+                "youtube_channel_id": "chanB",
+                "youtube_subscription_id": "subB",
+                "title": "Channel B",
+                "description": "d",
+                "thumbnail_url": "t",
+            },
         ],
     )
     monkeypatch.setattr(
@@ -39,8 +51,20 @@ def test_sync_subscriptions_idempotent_and_unsubscribes(monkeypatch, db_session)
         sync.youtube_client,
         "fetch_subscriptions",
         lambda creds: [
-            {"youtube_channel_id": "chanB", "title": "Channel B", "description": "d", "thumbnail_url": "t"},
-            {"youtube_channel_id": "chanC", "title": "Channel C", "description": "d", "thumbnail_url": "t"},
+            {
+                "youtube_channel_id": "chanB",
+                "youtube_subscription_id": "subB",
+                "title": "Channel B",
+                "description": "d",
+                "thumbnail_url": "t",
+            },
+            {
+                "youtube_channel_id": "chanC",
+                "youtube_subscription_id": "subC",
+                "title": "Channel C",
+                "description": "d",
+                "thumbnail_url": "t",
+            },
         ],
     )
 

tests/test_videos.py

@@ -158,3 +158,40 @@ def test_recheck_local_keeps_completed_when_media_reachable(client, db_session,
 
     assert resp.status_code == 200
     assert resp.json()["status"] == "completed"
+
+
+def test_delete_download_requires_completed_job(client, db_session):
+    video = _seed_single_video(db_session)
+    resp = client.delete(f"/api/videos/{video.youtube_video_id}/download")
+    assert resp.status_code == 400
+
+
+def test_delete_download_success(client, db_session, monkeypatch):
+    from app.models.download_job import DownloadJob
+
+    video = _seed_single_video(db_session)
+    job = DownloadJob(
+        video_id=video.id,
+        status="completed",
+        metube_job_id="vid1.vid1",
+        media_url="http://metube.local/download/f.mp4",
+    )
+    db_session.add(job)
+    db_session.commit()
+
+    calls = {}
+    monkeypatch.setattr(
+        "app.services.metube_client.MeTubeClient.delete_download",
+        lambda self, metube_job_id: calls.setdefault("id", metube_job_id) or {"status": "ok"},
+    )
+
+    resp = client.delete(f"/api/videos/{video.youtube_video_id}/download")
+
+    assert resp.status_code == 200
+    assert resp.json()["status"] == "deleted"
+    assert resp.json()["media_url"] is None
+    assert calls["id"] == "vid1.vid1"
+
+    db_session.refresh(job)
+    assert job.status == "deleted"
+    assert job.media_url is None

tests/test_youtube_client.py

@@ -40,12 +40,13 @@ def test_fetch_subscriptions_paginates(monkeypatch):
         {
             "items": [
                 {
+                    "id": "subA",
                     "snippet": {
                         "title": "Channel A",
                         "description": "desc a",
                         "resourceId": {"channelId": "chanA"},
                         "thumbnails": {"high": {"url": "http://thumb/a.jpg"}},
-                    }
+                    },
                 }
             ],
             "nextPageToken": "page2",
@@ -72,6 +73,7 @@ def test_fetch_subscriptions_paginates(monkeypatch):
     result = youtube_client.fetch_subscriptions(_credentials())
 
     assert [r["youtube_channel_id"] for r in result] == ["chanA", "chanB"]
+    assert result[0]["youtube_subscription_id"] == "subA"
     assert result[0]["thumbnail_url"] == "http://thumb/a.jpg"
     assert result[1]["thumbnail_url"] == "http://thumb/b.jpg"
 
@@ -143,6 +145,50 @@ def test_fetch_videos_details(monkeypatch):
     assert result[0]["thumbnail_url"] == "http://thumb/1.jpg"
 
 
+def test_unsubscribe_success(monkeypatch):
+    response = FakeResponse(204, {})
+    seen = {}
+
+    class FakeDeleteClient(FakeClient):
+        def delete(self, url, params=None, headers=None):
+            seen["params"] = params
+            return self._responses.pop(0)
+
+    monkeypatch.setattr(youtube_client.httpx, "Client", lambda timeout: FakeDeleteClient([response]))
+
+    youtube_client.unsubscribe(_credentials(), "sub123")
+
+    assert seen["params"] == {"id": "sub123"}
+
+
+def test_unsubscribe_already_gone_is_not_an_error(monkeypatch):
+    response = FakeResponse(404, {"error": {"message": "not found"}})
+
+    class FakeDeleteClient(FakeClient):
+        def delete(self, url, params=None, headers=None):
+            return self._responses.pop(0)
+
+    monkeypatch.setattr(youtube_client.httpx, "Client", lambda timeout: FakeDeleteClient([response]))
+
+    youtube_client.unsubscribe(_credentials(), "sub123")  # must not raise
+
+
+def test_unsubscribe_insufficient_scope(monkeypatch):
+    response = FakeResponse(
+        403,
+        {"error": {"message": "Request had insufficient authentication scopes.", "errors": [{"reason": "forbidden"}]}},
+    )
+
+    class FakeDeleteClient(FakeClient):
+        def delete(self, url, params=None, headers=None):
+            return self._responses.pop(0)
+
+    monkeypatch.setattr(youtube_client.httpx, "Client", lambda timeout: FakeDeleteClient([response]))
+
+    with pytest.raises(youtube_client.YouTubeInsufficientScope):
+        youtube_client.unsubscribe(_credentials(), "sub123")
+
+
 def test_fetch_uploads_playlists_batches(monkeypatch):
     response = FakeResponse(
         200,