Fix M10: consolidate .url Internet Shortcut parsing into shared utility

Both DownloadBar (renderer, drag-drop) and deeplink.ts (main, argv) had their
own regex to extract URL= from a Windows Internet Shortcut file -- with subtly
different patterns (/^\s*URL\s*=\s*(\S+)/ vs /^URL=(.+)$/).

Added parseUrlShortcutContent() to @shared/ipc. Both callers now delegate to
it and apply their own http/https guard (looksLikeUrl in renderer, asHttpUrl
in main). The local parseUrlFile wrapper in DownloadBar is kept as the
validation compositing point; it's now a one-liner.

typecheck + 242 tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/deeplink.ts

@@ -2,6 +2,7 @@ import { app, shell, type BrowserWindow } from 'electron'
 import { existsSync, openSync, readSync, closeSync } from 'fs'
 import { join } from 'path'
 import { assertHttpUrl } from './url'
+import { parseUrlShortcutContent } from '@shared/ipc'
 
 /** Only ever forward http(s) targets into the app — same restriction the
  *  external-link window-open handler in index.ts applies to in-page links.
@@ -29,8 +30,7 @@ function readUrlShortcut(path: string): string | null {
     fd = openSync(path, 'r')
     const buf = Buffer.alloc(MAX_URL_FILE_BYTES)
     const bytes = readSync(fd, buf, 0, buf.length, 0)
-    const match = /^URL=(.+)$/im.exec(buf.toString('utf8', 0, bytes))
-    const url = match?.[1]?.trim()
+    const url = parseUrlShortcutContent(buf.toString('utf8', 0, bytes))
     return url ? asHttpUrl(url) : null
   } catch {
     return null