feat(main): CC8 — file-backed leveled logger + renderer log sink

Diagnostics were invisible in a packaged build: main catches did a bare
console.error (DevTools suppressed in prod, M31) and the renderer's logError
(M29) wrote to an unreachable console. Add a small leveled logger
(src/main/logger.ts) appending to <userData>/logs/aerofetch.log with size-capped
rotation; all app/fs access is lazy+guarded so it's a safe no-op under tests.

- Route the 5 main-process console.* catch sites (jsonStore write-fail, settings
  write-fail + plaintext-secret warn, cookie loadURL, yt-dlp auto-update)
  through the logger.
- Add a fire-and-forget log:write IPC channel + preload logError() so the
  renderer's logError forwards failures to the main file sink (closes the M29
  "sink" half the code comments deferred to CC8). mockApi + Api type updated.
- Unit-test pure formatLine/composeMessage + no-op safety; update the R6
  jsonStore test to assert against the logger.

The user-facing toast half of CC8 ties to the global status surface (UI25/UX9).
typecheck + 258 tests + lint + prettier green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/settings.ts

@@ -1,6 +1,7 @@
 import { app, safeStorage } from 'electron'
 import Store from 'electron-store'
 import { isSafeFilenameTemplate, isSafeOutputDir } from './validation'
+import { logger } from './logger'
 import {
   AUDIO_FORMATS,
   VIDEO_CONTAINERS,
@@ -130,7 +131,7 @@ function encryptSecret(plain: string): string {
   // to be written in cleartext. Warn rather than fall back silently — a leaked
   // settings.json would then expose the proxy password / API token. (DPAPI is
   // effectively always present on Windows, so this should never fire in practice.)
-  console.warn('[AeroFetch] OS secret encryption unavailable — storing credential as plaintext.')
+  logger.warn('OS secret encryption unavailable — storing credential as plaintext')
   return plain
 }
 
@@ -238,7 +239,7 @@ export function setSettings(partial: Partial<Settings>): Settings {
     // handler or surface as an unhandled rejection. Log it; getSettings() below
     // returns the store's ACTUAL persisted state, so the renderer's reconciliation
     // (M34) reflects what truly saved instead of the optimistic value.
-    console.error('[AeroFetch] settings write failed:', e)
+    logger.error('settings write failed', e)
   }
   cachedSettings = null
   return getSettings()