Harden audit findings: correctness, type-safety, Windows conventions & polish

Audit-pass over CODE-AUDIT.md (~48 items closed this pass; all verified —
typecheck + 234 tests + eslint + prettier green).

Correctness / bugs:
- B3: match the release checksum to the asset's filename line (no wrong-hash verify)
- B4: newline-safe metadata probe (one --print with a unit-separator delimiter)
- B5 / L88: guard the meta event against canceled items; progress no longer promotes
  a queued item outside pump()
- B7: cookie-login promise always resolves (handles destroy-without-close)
- L146: trim parser rejects >2 colon-group times; M36: Library selection counts only
  actionable rows
- L11 / L50 / L156 / L57 / L159 / L15 / L3: live queue count, empty-cookie message,
  schedule picker min, dead-code/comment cleanup

Type safety:
- Enable noUncheckedIndexedAccess + noFallthroughCasesInSwitch (15 real edge cases fixed)

Resilience / Windows / metadata:
- R5: settings write failure handled (no unhandled IPC rejection; reconciles to truth)
- W1 / W5 / W6: min window size, seeded folder picker, parented sign-in window;
  L147 dead macOS branches removed
- CL1: shared stdout markers; package/builder metadata (license, homepage, repository,
  copyright, tsbuildinfo glob)

Copy / docs / tests:
- M37 / SR9 dev-jargon cleanup in hints; M8 / M25 / M26 / L66 / L80 / L81 reconciled
- New unit tests for L35 (isValidMediaItem) and L36 (compareVersions)

This commit also checkpoints the previously-uncommitted feat/tray-background-clipboard
work it builds on: background running + auto-download, library clipboard detection,
tray, binary management & library scale, credential encryption at rest, the shared
jsonStore and ui/ primitives, and the eslint/prettier tooling.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/renderer/src/reportError.ts

@@ -0,0 +1,13 @@
+// Centralized handler for fire-and-forget IPC (and similar async) calls whose
+// failure we want recorded but can't surface to the user — the optimistic store
+// update has already happened, so there's nothing to roll back or prompt about.
+// Replaces the swallowed `.catch(() => {})` sites the audit flagged (M29) with a
+// single, consistent log format. `op` names the operation, e.g. 'addHistory'.
+//
+// Note: in production the DevTools console isn't reachable (the app menu is
+// suppressed), so this is primarily a development/`--inspect` diagnostic until a
+// persistent renderer log sink lands (CC8). It is still strictly better than
+// discarding the error.
+export function logError(op: string): (e: unknown) => void {
+  return (e) => console.error(`[AeroFetch] ${op} failed:`, e)
+}