Fix M10: consolidate .url Internet Shortcut parsing into shared utility

Both DownloadBar (renderer, drag-drop) and deeplink.ts (main, argv) had their
own regex to extract URL= from a Windows Internet Shortcut file -- with subtly
different patterns (/^\s*URL\s*=\s*(\S+)/ vs /^URL=(.+)$/).

Added parseUrlShortcutContent() to @shared/ipc. Both callers now delegate to
it and apply their own http/https guard (looksLikeUrl in renderer, asHttpUrl
in main). The local parseUrlFile wrapper in DownloadBar is kept as the
validation compositing point; it's now a one-liner.

typecheck + 242 tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CODE-AUDIT.md

@@ -246,7 +246,7 @@ token system + shared primitives (UI/SIMP — high value, larger effort) · i18n
 - [x] **M9 — Three time formatters.** `relTime` (LibraryView), `formatWhen` (HistoryView),
   `fmtSchedule` (QueueItem) — consolidate into a date util. *Fixed: all three moved to
   [`datetime.ts`](src/renderer/src/datetime.ts) and imported by their views; unit-tested in `test/datetime.test.ts`.*
-- [ ] **M10 — `.url` shortcut parsing duplicated** — `parseUrlFile` (DownloadBar) vs
+- [x] **M10 — `.url` shortcut parsing duplicated** — `parseUrlFile` (DownloadBar) vs
   `readUrlShortcut` (main/deeplink). Different `URL=` extractors for the same file format.
 - [x] **M11 — Inconsistent clipboard access.** Reads use `navigator.clipboard.readText` (paste
   button) *and* `window.api.readClipboard` (suggestion watcher); writes use