Harden audit findings: correctness, type-safety, Windows conventions & polish

Audit-pass over CODE-AUDIT.md (~48 items closed this pass; all verified —
typecheck + 234 tests + eslint + prettier green).

Correctness / bugs:
- B3: match the release checksum to the asset's filename line (no wrong-hash verify)
- B4: newline-safe metadata probe (one --print with a unit-separator delimiter)
- B5 / L88: guard the meta event against canceled items; progress no longer promotes
  a queued item outside pump()
- B7: cookie-login promise always resolves (handles destroy-without-close)
- L146: trim parser rejects >2 colon-group times; M36: Library selection counts only
  actionable rows
- L11 / L50 / L156 / L57 / L159 / L15 / L3: live queue count, empty-cookie message,
  schedule picker min, dead-code/comment cleanup

Type safety:
- Enable noUncheckedIndexedAccess + noFallthroughCasesInSwitch (15 real edge cases fixed)

Resilience / Windows / metadata:
- R5: settings write failure handled (no unhandled IPC rejection; reconciles to truth)
- W1 / W5 / W6: min window size, seeded folder picker, parented sign-in window;
  L147 dead macOS branches removed
- CL1: shared stdout markers; package/builder metadata (license, homepage, repository,
  copyright, tsbuildinfo glob)

Copy / docs / tests:
- M37 / SR9 dev-jargon cleanup in hints; M8 / M25 / M26 / L66 / L80 / L81 reconciled
- New unit tests for L35 (isValidMediaItem) and L36 (compareVersions)

This commit also checkpoints the previously-uncommitted feat/tray-background-clipboard
work it builds on: background running + auto-download, library clipboard detection,
tray, binary management & library scale, credential encryption at rest, the shared
jsonStore and ui/ primitives, and the eslint/prettier tooling.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/generate-checksums.cjs

@@ -0,0 +1,36 @@
+// electron-builder `afterAllArtifactBuild` hook (H8).
+//
+// The in-app updater (src/main/updater.ts) sets REQUIRE_CHECKSUM = true and
+// refuses any release whose installer lacks a sibling `<installer>.exe.sha256`
+// asset — so a release published without one makes EVERY client's in-app update
+// fail. `build:win` never generated these, so they had to be made by hand (and
+// the 0.5.0 build shipped without any). This hook writes one next to every built
+// `.exe`, in `sha256sum` format (`<lowercase-hex>  <filename>`), which the
+// updater's extractSha256 parses (it just needs a standalone 64-char hex token).
+//
+// Returning the paths tells electron-builder to also upload them as release
+// assets when publishing.
+
+const { createHash } = require('crypto')
+const { readFileSync, writeFileSync } = require('fs')
+const { basename } = require('path')
+
+/** The `sha256sum`-format line for a file: "<lowercase-hex>  <basename>". */
+function checksumLine(filePath) {
+  const hex = createHash('sha256').update(readFileSync(filePath)).digest('hex')
+  return `${hex}  ${basename(filePath)}`
+}
+
+exports.default = function generateChecksums(context) {
+  const written = []
+  for (const file of context.artifactPaths) {
+    if (!/\.exe$/i.test(file)) continue
+    const out = `${file}.sha256`
+    writeFileSync(out, checksumLine(file) + '\n')
+    written.push(out)
+  }
+  return written
+}
+
+// Exported for unit testing the hashing/format without running electron-builder.
+exports.checksumLine = checksumLine