Fix H3/L30/L44/L60/L90/L25/L32 polish: dependencies, naming, consistency

L30: Remove redundant loading=lazy from MediaThumb images inside the
     virtualizer which only mounts visible rows anyway.
L44: electron-builder.yml now excludes the actual eslint.config.js and
     .prettierrc rather than non-existent legacy .eslintrc/.prettierrc.yaml.
L60: IpcChannels.externalUrl renamed from external-url to app:external-url
     to match every other channel name category prefix.
L90: settings.ts sanitizeOptions now uses (ARR as readonly string[]).includes
     pattern consistently with setSettings; removes the as-never hack.

typecheck + 242 tests + eslint + prettier green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CODE-AUDIT.md

@@ -438,7 +438,7 @@ token system + shared primitives (UI/SIMP — high value, larger effort) · i18n
   ref; changing the default in Settings while on the Downloads tab isn't reflected until reload.
 - [ ] **L29 — UI constant in the store.** `QUALITY_OPTIONS` lives in `store/downloads.ts` yet is a
   presentational constant imported by views — couples UI to the store module.
-- [ ] **L30 — Redundant `loading="lazy"`** on `MediaThumb` images already inside a virtualized
+- [x] **L30 — Redundant `loading="lazy"`** on `MediaThumb` images already inside a virtualized
   list (the virtualizer only mounts visible rows).
 - [ ] **L31 — Two theme switchers.** Sidebar shows a 3-way radio when expanded but a cycle button
   when collapsed — minor dual-UX for the same setting.
@@ -465,7 +465,7 @@ token system + shared primitives (UI/SIMP — high value, larger effort) · i18n
   URL (surfaced by the NSIS installer).
 - [x] **L42 — `package.json` has no `license` field** (ships LGPL ffmpeg + GPL aria2c).
 - [x] **L43 — `package.json` has no `repository` field** (real repo is the Gitea instance).
-- [ ] **L44 — Vestigial lint excludes.** `electron-builder.yml` excludes `.eslintrc`/`.prettierrc`
+- [x] **L44 — Vestigial lint excludes.** `electron-builder.yml` excludes `.eslintrc`/`.prettierrc`
   but there's no ESLint/Prettier config, script, or dependency — no enforced style tooling.
 - [x] **L45 — Three self-descriptions** drift: pkg `description` "A yt-dlp frontend for Windows" vs
   builder `copyright` "yt-dlp frontend" vs Sidebar caption "yt-dlp frontend".
@@ -493,7 +493,7 @@ token system + shared primitives (UI/SIMP — high value, larger effort) · i18n
 - [x] **L58 — `chooseFolder` passes the macOS-only `createDirectory` property** — dead option on Windows.
 - [ ] **L59 — `THEME_BACKGROUND` (index.ts) duplicates `pageBackground` (theme.ts)** — two
   hand-synced color constants (a "keep in sync" comment guards them).
-- [ ] **L60 — `'external-url'` channel name lacks the `category:` prefix** every other IPC channel uses.
+- [x] **L60 — `'external-url'` channel name lacks the `category:` prefix** every other IPC channel uses.
 - [ ] **L61 — `taskbarProgress` is the lone `ipcMain.on`** (fire-and-forget) amid all-`invoke` channels.
 - [ ] **L62 — "Best available" synthetic format hardcodes `ext:'mp4'`/`hasAudio:true`** (probe.ts) —
   mislabels when the chosen container is mkv/webm.
@@ -555,7 +555,7 @@ token system + shared primitives (UI/SIMP — high value, larger effort) · i18n
 
 *Round 5 (2026-06-29) — code-level micro-inconsistencies & polish:*
 
-- [ ] **L90 — Two idioms for "value in const array."** [settings.ts](src/main/settings.ts) `sanitizeOptions`
+- [x] **L90 — Two idioms for "value in const array."** [settings.ts](src/main/settings.ts) `sanitizeOptions`
   uses `ARR.includes(x as never)` (L116–120) while `setSettings` uses `(ARR as readonly string[]).includes(x as string)` (L275/323). Pick one.
 - [x] **L91 — Unsafe tuple cast / fragile encoding.** `value.split('|') as [MediaKind, string]`
   ([SettingsView.tsx](src/renderer/src/components/SettingsView.tsx):411) trusts a `'|'`-joined