refactor(api): remove dead code paths in serve/remote layer

Delete code paths that never executed in the serve/API/remote stack:

- BridgeCancelledError: raised but never caught; replace raises with RuntimeError and drop the class.
- InputBridge.error setter and _error field: written at the handler layer, never read (session.auth_error is the surfaced channel).
- cancel_event param and _check_cancel inner fn on _perform_download: the only caller always passed None (the live job.cancel_event is untouched).
- result_with_progress monkeypatch: its status pings were redundant with the file-polled progress_sink, which is now the sole path.
- session param on _resolve_manifest_data: unused in the body.

Reconcile SessionStore's hardcoded 600s auth-state TTL into a shared AUTH_INPUT_TIMEOUT constant referenced by both the InputBridge input timeout and the store, removing the magic number without changing the longer grace window.

Update input_bridge/session_store tests for the new channels and add an assertion that auth-state entries expire at the single rule.

tests/remote/unit/test_session_store.py

@@ -85,6 +85,21 @@ async def test_cleanup_expired_keeps_pending_input_under_grace(store: SessionSto
     assert store.session_count == 1
 
 
+async def test_cleanup_expired_drops_pending_input_past_grace(store: SessionStore) -> None:
+    """The auth-state grace is the single AUTH_INPUT_TIMEOUT rule, not a separate magic number."""
+    from datetime import datetime, timedelta, timezone
+
+    from unshackle.core.api.input_bridge import AUTH_INPUT_TIMEOUT
+
+    entry = await store.create("ATV", _FakeService())
+    entry.input_bridge = InputBridge()
+    entry.auth_status = AuthStatus.PENDING_INPUT
+    entry.last_accessed = datetime.now(timezone.utc) - timedelta(seconds=AUTH_INPUT_TIMEOUT + 1)
+    removed = await store.cleanup_expired()
+    assert removed == 1
+    assert store.session_count == 0
+
+
 async def test_cancel_all_bridges(store: SessionStore) -> None:
     a = await store.create("ATV", _FakeService())
     b = await store.create("NF", _FakeService())