…by a corporate network

Closes #3655.

Model downloads (pyannote speaker segmentation/embedding) fail opaquely on
corporate networks that do TLS interception, require a proxy, or sit behind a
captive portal. The raw reqwest error ("error sending request", "invalid peer
certificate: UnknownIssuer") tells the user nothing about what to do.

Classify the common failure modes and attach an actionable hint:
- TLS cert rejected: MITM proxy, trust the corp root cert
- DNS lookup failed: network/VPN/DNS
- connection refused/reset/unreachable: firewall/proxy
- timeout: proxy throttling
- HTTP 407/401/403/511 and unexpected redirects: proxy auth / captive portal
- 200 OK with text/html body: captive portal serving a login page, not the model

The string matcher is split into a pure classify_download_failure helper with a
unit test (reqwest::Error has no public constructor, so the typed timeout check
stays in the thin wrapper).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>