security: harden command exec, IPC, deep-link, cookies, and persistence

Seven-tier security audit of the main process, each finding fixed with a
regression test. Typecheck (node + web) clean; unit tests 106 -> 140.

- Tier 1 (command exec/argv): allowlist the yt-dlp --update-to channel
  (blocks arbitrary-binary-install RCE); gate per-download extraArgs behind
  the customCommandEnabled consent flag in main (blocks --exec RCE); resolve
  taskkill/schtasks by absolute System32 path; validate per-download
  outputDir; normalize the URL in assertHttpUrl and use it at every spawn.
- Tier 2 (input validation): fix isSafeFilenameTemplate drive-relative
  ('C:foo') and Windows dotted-'..' traversal bypasses; percent-encode the
  untrusted id in entryUrl; catch reserved device names with extensions in
  sanitizeDirSegment.
- Tier 3 (fs/backup): drop malformed template rows in importBackup;
  normalize deep-link URLs via assertHttpUrl.
- Tier 4 (cookies): confine the sign-in window's navigations/popups to web
  URLs (recursively) and deny all web permissions on its session.
- Tier 5 (deep-link/argv): bound the .url file read to 64 KB; match the
  aerofetch:// scheme case-insensitively.
- Tier 6 (Electron window): deny camera/mic/geolocation/USB/HID/serial/
  Bluetooth permissions on the app window.
- Tier 7 (network/persistence): restrict the watched-source RSS fetch to
  youtube.com feed URLs (SSRF guard); complete isValidSource validation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/shared/ipc.ts

@@ -186,8 +186,23 @@ export interface YtdlpVersionResult {
   error?: string
 }
 
-/** yt-dlp's self-update release channel (`--update-to <channel>`). */
-export type YtdlpUpdateChannel = 'stable' | 'nightly'
+/**
+ * yt-dlp's self-update release channels (`--update-to <channel>`).
+ *
+ * SECURITY (audit F1): `--update-to` also accepts an `OWNER/REPO@TAG` spec, which
+ * makes yt-dlp download a release binary from an ARBITRARY GitHub repo and
+ * overwrite the running yt-dlp.exe — i.e. arbitrary, persistent code execution.
+ * The TypeScript type is erased at runtime and is no defence over IPC, so the
+ * value must be checked against this allowlist before it ever reaches the flag
+ * (see isYtdlpUpdateChannel; enforced in src/main/ytdlp.ts).
+ */
+export const YTDLP_UPDATE_CHANNELS = ['stable', 'nightly'] as const
+export type YtdlpUpdateChannel = (typeof YTDLP_UPDATE_CHANNELS)[number]
+
+/** Runtime guard for an untrusted update-channel value crossing the IPC boundary. */
+export function isYtdlpUpdateChannel(v: unknown): v is YtdlpUpdateChannel {
+  return typeof v === 'string' && (YTDLP_UPDATE_CHANNELS as readonly string[]).includes(v)
+}
 
 export interface YtdlpUpdateResult {
   ok: boolean