security: harden command exec, IPC, deep-link, cookies, and persistence

Seven-tier security audit of the main process, each finding fixed with a
regression test. Typecheck (node + web) clean; unit tests 106 -> 140.

- Tier 1 (command exec/argv): allowlist the yt-dlp --update-to channel
  (blocks arbitrary-binary-install RCE); gate per-download extraArgs behind
  the customCommandEnabled consent flag in main (blocks --exec RCE); resolve
  taskkill/schtasks by absolute System32 path; validate per-download
  outputDir; normalize the URL in assertHttpUrl and use it at every spawn.
- Tier 2 (input validation): fix isSafeFilenameTemplate drive-relative
  ('C:foo') and Windows dotted-'..' traversal bypasses; percent-encode the
  untrusted id in entryUrl; catch reserved device names with extensions in
  sanitizeDirSegment.
- Tier 3 (fs/backup): drop malformed template rows in importBackup;
  normalize deep-link URLs via assertHttpUrl.
- Tier 4 (cookies): confine the sign-in window's navigations/popups to web
  URLs (recursively) and deny all web permissions on its session.
- Tier 5 (deep-link/argv): bound the .url file read to 64 KB; match the
  aerofetch:// scheme case-insensitively.
- Tier 6 (Electron window): deny camera/mic/geolocation/USB/HID/serial/
  Bluetooth permissions on the app window.
- Tier 7 (network/persistence): restrict the watched-source RSS fetch to
  youtube.com feed URLs (SSRF guard); complete isValidSource validation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/backup.ts

@@ -2,6 +2,7 @@ import { dialog, type BrowserWindow } from 'electron'
 import { readFileSync, writeFileSync } from 'fs'
 import { getSettings, setSettings } from './settings'
 import { listTemplates, replaceTemplates } from './templates'
+import { isTemplateLike } from './validation'
 import type {
   BackupExportResult,
   BackupImportResult,
@@ -55,8 +56,12 @@ export async function importBackup(win: BrowserWindow | undefined): Promise<Back
     file.settings && typeof file.settings === 'object'
       ? (file.settings as Partial<Settings>)
       : undefined
+  // Drop non-object / id-less entries up front (audit T3) so both the consent
+  // check below and replaceTemplates see only well-shaped rows. Without this a
+  // backup with a null/garbage templates entry throws in sanitize() instead of
+  // degrading gracefully as this function promises.
   const incomingTemplates = Array.isArray(file.templates)
-    ? (file.templates as CommandTemplate[])
+    ? (file.templates as CommandTemplate[]).filter(isTemplateLike)
     : []
 
   // A custom-command template's `args` are extra yt-dlp flags that get spawned on