feat(audit): L51 + L64 — daily-sync time picker + aria2c connection tuning

Two small self-contained features from the audit's deferred list:

- L51: the Task Scheduler daily sync is no longer pinned to 09:00. New
  Settings.syncTime (24h HH:MM) with a native time input beside the Library
  "Daily sync" switch — persists on change, re-registers the task on blur
  (schtasks /Create /F overwrite is the time-change mechanism). The value
  reaches the schtasks /ST argv, so a shared isValidSyncTime guards it at
  both the settings write and in schedule.ts (unit-tested incl.
  injection-shaped input). Live-verified against the machine's real task.

- L64: aria2c connection count (-x/-s) is user-tunable. New
  Settings.aria2cConnections (1-16, aria2c's own ceiling) exposed as a
  SpinButton in Settings -> Network while the aria2c toggle is on.
  ARIA2C_ARGS became the pure aria2cArgs(n?) with a defensive clamp;
  threaded through AccessOptions. The -k 1M split floor stays fixed — a
  free-text field would bypass the custom-command consent gate.

typecheck + 309 tests + eslint + production build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CODE-AUDIT.md

@@ -797,9 +797,16 @@ token system + shared primitives (UI/SIMP — high value, larger effort) · i18n
   `\n`, which renders awkwardly in inline/Caption error spans.
 - [x] **L50 — "Cookies saved" shown for 0 cookies.** Closing the sign-in window without logging in
   still writes the file and reports `ok` with `cookieCount: 0`.
-- [ ] **L51 — Scheduled daily sync time hardcoded to 09:00** (schedule.ts) — on/off toggle only, no time picker.
-  *Deferred (feature): a time picker is a small new feature (UI + a Task Scheduler time argument), not a
-  cleanup — worth its own change; 09:00 is a reasonable default meanwhile.*
+- [x] **L51 — Scheduled daily sync time hardcoded to 09:00** (schedule.ts) — on/off toggle only, no time picker.
+  *Fixed. New `Settings.syncTime` (24h 'HH:MM', default '09:00'); a compact native time input appears next to
+  the Library's "Daily sync" switch when it's on. `setScheduledSync(enabled, time?)` threads the time into
+  `schtasks /ST`, guarded by a shared `isValidSyncTime` (in @shared/ipc, used by both main's settings
+  validation and schedule.ts — the value reaches the schtasks argv, so malformed input falls back to the
+  default rather than being forwarded; unit-tested incl. injection-shaped values). The picker persists via
+  settings on change and re-registers the task on blur (one `schtasks /Create /F` per commit, not per
+  keystroke — /F overwrite IS the time-change mechanism). Live-verified on this machine: re-registering the
+  real AeroFetchDailySync task with /ST 19:30 moved its start to 7:30 PM and back (the user's original 09:00
+  registration restored byte-exact afterwards).*
 - [x] **L52 — Installer handoff is a fixed `setTimeout(app.quit, 1500)`** (updater.ts) — a race on slow machines.
 - [x] **L53 — `dialog.show*Dialog(win!, …)` non-null assertions** on a possibly-null window
   (chooseFolder, backup export/import) — can throw if the sender window is gone.
@@ -818,9 +825,15 @@ token system + shared primitives (UI/SIMP — high value, larger effort) · i18n
 - [x] **L62 — "Best available" synthetic format hardcodes `ext:'mp4'`/`hasAudio:true`** (probe.ts) —
   mislabels when the chosen container is mkv/webm.
 - [x] **L63 — `audioQuality()` unknown label → silent `'0'` (best)** — the audio analog of H5.
-- [ ] **L64 — `ARIA2C_ARGS` connection params hardcoded** (`-x16 -s16 -k1M`), no user control.
-  *Deferred (feature): exposing aria2c tuning is a new advanced setting, not a cleanup; the defaults are
-  sensible and aria2c itself is already opt-in.*
+- [x] **L64 — `ARIA2C_ARGS` connection params hardcoded** (`-x16 -s16 -k1M`), no user control.
+  *Fixed. New `Settings.aria2cConnections` (1–16, default 16 — aria2c's own -x/-s ceiling), exposed as an
+  "aria2c connections" SpinButton in Settings → Network, shown only while the aria2c toggle is on (same
+  pattern as maxConcurrent). The const became a pure `aria2cArgs(connections?)` in buildArgs.ts that clamps/
+  rounds defensively (settings validation clamps too — `applySettings` mirrors the maxConcurrent case);
+  `ARIA2C_ARGS` remains exported as `aria2cArgs()` so existing references stay valid. Threaded through
+  `AccessOptions.aria2cConnections` from buildCommand. The `-k 1M` split floor stays fixed — the meaningful
+  user knob is connection count; a free-text field would bypass the customCommandEnabled consent gate.
+  Unit-tested: custom count reaches `--downloader-args`, clamp floor/ceiling/rounding/non-finite.*
 - [x] **L65 — Pause uses `taskkill /F`** like cancel — a forced kill risks an unflushed `.part` tail vs a graceful stop.
   *Verified acceptable in the Batch 15 live pass — no code change needed. Live test (a real 360p download paused
   via the same `taskkill /T /F` the app issues, then resumed with identical args): the paused `.part` was left