Fix direct URL relative destination not resolved against DOWNLOADS_DIR

[bradleesand]

Summary

• _run_direct_url_with_cli receives destination from the UI as a relative path (e.g. Singles) but passed it directly to ensure_dir() and finalize_download_artifact(), causing os.makedirs to resolve it against the process CWD (/app) instead of DOWNLOADS_DIR (/downloads)
• When running as a non-root user this raises PermissionError: [Errno 13] Permission denied: 'Singles'; when running as root it silently writes files inside the container rather than the mounted downloads volume
• The job queue path correctly calls resolve_dir(raw, paths.single_downloads_dir) for this reason — this fix applies the same logic to the direct URL CLI path

Test plan

• Submit a direct URL (e.g. Facebook reel) with a relative single_download_folder configured (e.g. Singles) — file should land in $DOWNLOADS_DIR/Singles/ instead of erroring
• Submit a direct URL with no destination set — file should land in $DOWNLOADS_DIR/ as before
• Submit a direct URL with an absolute destination — should still work unchanged

[loganbuilt]

Thanks for catching this!!

The bug is real, but before merging I want this path to use the same resolution logic as the queue path, including rejecting destinations that escape DOWNLOADS_DIR via inputs like ../.... Can you update this to use the shared resolve_dir(...) helper and add a regression test for both a relative destination like Singles and an escape case? I’m happy to re-review after that.

I appreciate your contribution!

[loganbuilt]

Will merge as-is for to main and will implement the hard fix on the latest dev branch