Apply all CODE-AUDIT.md findings (S1-S5, P1-P3, M1-M3)

Security:
- S1 (backup.ts): require explicit confirmation before enabling custom-command
  templates from a backup file; import templates in a disabled state if declined
- S2 (cookies.ts): deny non-http/https popups in cookie login window, matching
  the main window's setWindowOpenHandler defence
- S3 (download.ts): main-process concurrency cap — startDownload now rejects
  spawns when active.size >= maxConcurrent (defence-in-depth; renderer already
  enforces this but should not be the only gate)
- S4 (settings.ts, validation.ts): reject filenameTemplate values containing
  path traversal (.. segments or absolute paths); validate outputDir is absolute
- S5 (history.ts, errorlog.ts, templates.ts, validation.ts): per-field
  validation on JSON reads — invalid entries dropped rather than blindly trusted

Performance:
- P1 (settings.ts): getSettings() now only writes to disk when sanitization
  actually changed a value; removes synchronous file I/O on every hot-path read
- P2 (ipc.ts, download.ts, downloads.ts): renderer forwards its pre-probed
  metadata (title/channel/duration) via StartDownloadOptions.meta; main uses
  it directly instead of spawning a redundant second yt-dlp probe

Maintainability:
- M1 (log.ts, download.ts, probe.ts): extract duplicated cleanError() to
  src/main/log.ts; both callers import from the shared module
- M2 (buildArgs.ts): document parseExtraArgs escape-sequence limitations
- M3 (electron-builder.yml): clarify icon TODO as a pre-release action
- P3 (downloads.ts): document that lowering maxConcurrent mid-flight does
  not pause active downloads (intended behaviour, now written down)

Tests:
- Add test/validation.test.ts covering isSafeFilenameTemplate, isSafeOutputDir,
  isValidHistoryEntry, isValidErrorLogEntry, isTemplateLike (76 tests pass)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/main/cookies.ts

@@ -116,13 +116,24 @@ export function openCookieLoginWindow(url: string): Promise<CookiesLoginResult>
 
     // Some sites log in via an OAuth/SSO popup. Let those open as real windows
     // sharing the same partition, rather than silently swallowing the click.
-    win.webContents.setWindowOpenHandler(() => ({
-      action: 'allow',
-      overrideBrowserWindowOptions: {
-        autoHideMenuBar: true,
-        webPreferences: { partition: PARTITION, sandbox: true, contextIsolation: true, nodeIntegration: false }
+    // Restrict popups to http(s) only — the same defence the main window applies
+    // (index.ts) — so a logged-in page can't open a file:// popup to exfil cookies
+    // to disk or use a custom-protocol popup as a pivot.
+    win.webContents.setWindowOpenHandler((details) => {
+      try {
+        const { protocol } = new URL(details.url)
+        if (protocol !== 'http:' && protocol !== 'https:') return { action: 'deny' }
+      } catch {
+        return { action: 'deny' } // unparseable URL — never open it
       }
-    }))
+      return {
+        action: 'allow',
+        overrideBrowserWindowOptions: {
+          autoHideMenuBar: true,
+          webPreferences: { partition: PARTITION, sandbox: true, contextIsolation: true, nodeIntegration: false }
+        }
+      }
+    })
 
     win.on('closed', () => {
       loginWindow = null