feat: self-managing yt-dlp + ffmpeg version display

yt-dlp is now a managed, auto-updating binary rather than a static bundled
one. On launch AeroFetch seeds a writable copy under userData from the
bundled seed, self-heals it if it goes missing, and — throttled to once a
day — self-updates it to the configured channel (default: nightly). This
keeps the binary current so YouTube changes don't silently cause 403s, and
an app reinstall (or portable re-extraction) can no longer roll it back.
Settings shows an auto-update toggle, the live version, last-checked time,
and the channel selector.

Also surface the bundled ffmpeg/ffprobe versions in Settings (display only:
they have no self-update path and, unlike yt-dlp, don't break as sites
change, so there is no auto-update for them).

- binaries: split the read-only bundled seed from the managed userData copy
- ytdlp: ensureManagedYtdlp (seed + self-heal), startup auto-update runner
- ytdlpPolicy: pure once-a-day throttle decision (unit-tested)
- ffmpeg: parse ffmpeg/ffprobe -version for the Settings panel
- settings/ipc/preload/renderer: new settings, IPC channels, types, and UI

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/ffmpeg.ts

@@ -0,0 +1,36 @@
+import { execFile } from 'child_process'
+import { existsSync } from 'fs'
+import { getFfmpegPath, getFfprobePath } from './binaries'
+import type { FfmpegVersionResult } from '@shared/ipc'
+
+/**
+ * Read the version token from an ffmpeg/ffprobe binary. Both print a first line
+ * of the form "<tool> version <VERSION> Copyright ..." (e.g.
+ * "ffmpeg version 6.1.1-full_build-www.gyan.dev Copyright ..."), so we return the
+ * token after "version". Resolves null if the binary is absent, errors, times
+ * out, or the line doesn't parse — Settings then shows "not found" instead of
+ * failing. Unlike yt-dlp these are never self-updated, so there's no update path.
+ */
+function readToolVersion(path: string): Promise<string | null> {
+  if (!existsSync(path)) return Promise.resolve(null)
+  return new Promise((resolve) => {
+    execFile(path, ['-version'], { windowsHide: true, timeout: 15_000 }, (err, stdout) => {
+      if (err) {
+        resolve(null)
+        return
+      }
+      const firstLine = stdout.split('\n', 1)[0] ?? ''
+      const m = firstLine.match(/version\s+(\S+)/i)
+      resolve(m ? m[1] : null)
+    })
+  })
+}
+
+/** Versions of the bundled ffmpeg + ffprobe, read in parallel for the Settings panel. */
+export async function getFfmpegVersions(): Promise<FfmpegVersionResult> {
+  const [ffmpeg, ffprobe] = await Promise.all([
+    readToolVersion(getFfmpegPath()),
+    readToolVersion(getFfprobePath())
+  ])
+  return { ffmpeg, ffprobe }
+}