security: harden command exec, IPC, deep-link, cookies, and persistence

Seven-tier security audit of the main process, each finding fixed with a
regression test. Typecheck (node + web) clean; unit tests 106 -> 140.

- Tier 1 (command exec/argv): allowlist the yt-dlp --update-to channel
  (blocks arbitrary-binary-install RCE); gate per-download extraArgs behind
  the customCommandEnabled consent flag in main (blocks --exec RCE); resolve
  taskkill/schtasks by absolute System32 path; validate per-download
  outputDir; normalize the URL in assertHttpUrl and use it at every spawn.
- Tier 2 (input validation): fix isSafeFilenameTemplate drive-relative
  ('C:foo') and Windows dotted-'..' traversal bypasses; percent-encode the
  untrusted id in entryUrl; catch reserved device names with extensions in
  sanitizeDirSegment.
- Tier 3 (fs/backup): drop malformed template rows in importBackup;
  normalize deep-link URLs via assertHttpUrl.
- Tier 4 (cookies): confine the sign-in window's navigations/popups to web
  URLs (recursively) and deny all web permissions on its session.
- Tier 5 (deep-link/argv): bound the .url file read to 64 KB; match the
  aerofetch:// scheme case-insensitively.
- Tier 6 (Electron window): deny camera/mic/geolocation/USB/HID/serial/
  Bluetooth permissions on the app window.
- Tier 7 (network/persistence): restrict the watched-source RSS fetch to
  youtube.com feed URLs (SSRF guard); complete isValidSource validation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

test/indexer.test.ts

@@ -4,6 +4,7 @@ import {
   buildMediaItems,
   mergeItemsPreservingState,
   buildFeedUrl,
+  isYouTubeFeedUrl,
   parseRssVideoIds,
   entryUrl,
   fmtDuration,
@@ -57,6 +58,10 @@ describe('entryUrl', () => {
     expect(entryUrl({ url: 'javascript:alert(1)' })).toBeNull()
     expect(entryUrl({})).toBeNull()
   })
+  it('percent-encodes an untrusted id rather than splicing it raw (audit T2)', () => {
+    expect(entryUrl({ id: 'ab cd&x=1' })).toBe('https://www.youtube.com/watch?v=ab%20cd%26x%3D1')
+    expect(entryUrl({ id: 'vid123' })).toBe('https://www.youtube.com/watch?v=vid123') // unchanged
+  })
 })
 
 describe('fmtDuration', () => {
@@ -189,6 +194,26 @@ describe('buildFeedUrl', () => {
   })
 })
 
+describe('isYouTubeFeedUrl (audit T7 — SSRF guard)', () => {
+  it('accepts a youtube feeds URL (www optional) and what buildFeedUrl produces', () => {
+    expect(isYouTubeFeedUrl('https://www.youtube.com/feeds/videos.xml?channel_id=UCabc')).toBe(true)
+    expect(isYouTubeFeedUrl('https://youtube.com/feeds/videos.xml?playlist_id=PLxyz')).toBe(true)
+    expect(isYouTubeFeedUrl(buildFeedUrl('channel', 'UCabc')!)).toBe(true)
+    expect(isYouTubeFeedUrl(buildFeedUrl('playlist', 'PLxyz')!)).toBe(true)
+  })
+
+  it('rejects internal/arbitrary hosts, wrong scheme, and wrong path (SSRF vectors)', () => {
+    expect(isYouTubeFeedUrl('http://169.254.169.254/latest/meta-data/')).toBe(false) // cloud metadata
+    expect(isYouTubeFeedUrl('http://localhost:8080/admin')).toBe(false)
+    expect(isYouTubeFeedUrl('https://evil.com/feeds/videos.xml')).toBe(false)
+    expect(isYouTubeFeedUrl('https://notyoutube.com.evil.com/feeds/videos.xml')).toBe(false)
+    expect(isYouTubeFeedUrl('http://www.youtube.com/feeds/videos.xml')).toBe(false) // not https
+    expect(isYouTubeFeedUrl('https://www.youtube.com/watch?v=x')).toBe(false) // wrong path
+    expect(isYouTubeFeedUrl('file:///etc/passwd')).toBe(false)
+    expect(isYouTubeFeedUrl('not a url')).toBe(false)
+  })
+})
+
 describe('parseRssVideoIds', () => {
   it('extracts every <yt:videoId> from a feed body, in order', () => {
     const xml = `