feat(daemon): make the download folder a live setting in both modes

The full-surface audit found the settings story half-true: `config set
download_dir` and the TUI's settings form edited a file a running daemon
never rereads, while the attached TUI displayed the laptop's path and
discarded the edit entirely.

- `download.set_dir`: a session-wide move, published in the contract;
  the per-transfer destination stays refused. `daemon.status` reports
  it and the next transfer lands there.
- `config set download_dir` and `config set shared_dirs` push to a
  live daemon the way `shares add` does, through one shared helper;
  the socket probe is paid only by the keys a daemon owns.
- The attached TUI seeds its settings form from the daemon's status,
  pushes both folders over the socket as typed, reports a partial
  refusal as exactly that, and creates no client-side directories. It
  reads the daemon token from the resolved config — with the token only
  in config.toml it could not attach over TCP — and settings
  persistence honours --config instead of hard-coding the default path.
- `search.wishlist` records a start time, so an attached window
  renders it as running rather than instantly finished.

The rest is the coverage the audit demanded: CLI-level token auth
(wrong, missing, and valid over TCP), `daemon status|stop` with
nothing running, --sort, --limit, --pick first, --password-cmd,
--log-file, --upload-slots, the config-named download folder in both
modes, and headless settings-form tests attached and local. Every
guard was checked by disabling what it protects. Both e2e modes run
green: 94 CLI tests each way, 16 protocol, 285 unit, 34 lib.

soulseek-rs/src/api.rs

@@ -152,6 +152,13 @@ pub trait SessionApi: Send + Sync {
     fn shared_counts(&self) -> (u32, u32);
     fn shared_directories(&self) -> Vec<String>;
     fn set_shared_directories(&self, directories: Vec<String>) -> Result<()>;
+
+    /// Point future transfers at `directory`.
+    ///
+    /// Only a daemon holds a download folder of its own — locally every
+    /// download call names its directory, so the local session has nothing to
+    /// store and accepts silently.
+    fn set_download_directory(&self, directory: String) -> Result<()>;
 }
 
 /// The local session: the library client itself, so `Arc<Client>` is already an
@@ -353,4 +360,8 @@ impl SessionApi for Client {
     fn set_shared_directories(&self, directories: Vec<String>) -> Result<()> {
         Self::set_shared_directories(self, directories)
     }
+
+    fn set_download_directory(&self, _directory: String) -> Result<()> {
+        Ok(())
+    }
 }