feat(audit): L51 + L64 — daily-sync time picker + aria2c connection tuning

Two small self-contained features from the audit's deferred list:

- L51: the Task Scheduler daily sync is no longer pinned to 09:00. New
  Settings.syncTime (24h HH:MM) with a native time input beside the Library
  "Daily sync" switch — persists on change, re-registers the task on blur
  (schtasks /Create /F overwrite is the time-change mechanism). The value
  reaches the schtasks /ST argv, so a shared isValidSyncTime guards it at
  both the settings write and in schedule.ts (unit-tested incl.
  injection-shaped input). Live-verified against the machine's real task.

- L64: aria2c connection count (-x/-s) is user-tunable. New
  Settings.aria2cConnections (1-16, aria2c's own ceiling) exposed as a
  SpinButton in Settings -> Network while the aria2c toggle is on.
  ARIA2C_ARGS became the pure aria2cArgs(n?) with a defensive clamp;
  threaded through AccessOptions. The -k 1M split floor stays fixed — a
  free-text field would bypass the custom-command consent gate.

typecheck + 309 tests + eslint + production build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/settings.ts

@@ -14,6 +14,7 @@ import {
   DEFAULT_DOWNLOAD_OPTIONS,
   DEFAULT_SETTINGS,
   isYtdlpUpdateChannel,
+  isValidSyncTime,
   type Settings,
   type DownloadOptions,
   type SponsorBlockCategory,
@@ -266,6 +267,17 @@ function applySettings(s: Store<Settings>, partial: Partial<Settings>): void {
         if (Number.isFinite(n)) s.set('maxConcurrent', Math.min(5, Math.max(1, Math.round(n))))
         break
       }
+      case 'aria2cConnections': {
+        // aria2c caps -x/-s at 16; clamp like maxConcurrent rather than reject (L64).
+        const n = Number(value)
+        if (Number.isFinite(n)) s.set('aria2cConnections', Math.min(16, Math.max(1, Math.round(n))))
+        break
+      }
+      case 'syncTime':
+        // Reaches `schtasks /ST` when the daily sync is (re)registered — only a
+        // well-formed 24h HH:MM is ever stored (L51).
+        if (isValidSyncTime(value)) s.set('syncTime', value)
+        break
       case 'clipboardWatch':
       case 'useAria2c':
       case 'restrictFilenames':