Encrypt credentials at rest; unify clipboard-link suggestions

Encrypt proxy / youtubePoToken / updateToken on disk via safeStorage (DPAPI on Windows), with a one-time launch migration for legacy plaintext. Decrypted before reaching callers/renderer; backup export still writes clear, as documented. Harden updater token handling to refuse cross-origin redirects on the authenticated REST check.

Extract the clipboard-link logic from DownloadBar into the shared useClipboardLink hook: add an optional filter (library skips single-video links), an offer() for external aerofetch:// / .url links, and a source field driving banner wording. Add looksLikeSingleVideo plus its unit tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/index.ts

@@ -23,7 +23,13 @@ import {
   hasActiveDownloads
 } from './download'
 import { runTerminal, cancelTerminal } from './terminal'
-import { getSettings, setSettings, ensureMediaDirs, applyLaunchAtStartup } from './settings'
+import {
+  getSettings,
+  setSettings,
+  ensureMediaDirs,
+  applyLaunchAtStartup,
+  migrateSecretsAtRest
+} from './settings'
 import { listHistory, addHistory, removeHistory, removeManyHistory, clearHistory } from './history'
 import { listTemplates, saveTemplate, removeTemplate } from './templates'
 import { setupPortableData } from './portable'
@@ -398,6 +404,10 @@ if (isPrimaryInstance) {
     // exist from first launch (downloads are routed into them by kind).
     ensureMediaDirs()
 
+    // Encrypt any credential still stored as legacy plaintext (from before at-rest
+    // encryption), once safeStorage is available post-ready.
+    migrateSecretsAtRest()
+
     // Sync the Windows "run at sign-in" entry with the persisted setting, so it
     // reflects the user's choice even if they changed it on another install.
     applyLaunchAtStartup(getSettings().launchAtStartup)