Add Seal-parity download options + playlist support (Phase A)

Phase A of the Seal feature-parity roadmap: configurable post-processing via a
shared DownloadOptions model (src/shared/ipc.ts), editable as persisted defaults
in Settings and overridable per-download in the download bar.

- audio formats (mp3/m4a/opus/flac/wav/aac), video container (mp4/mkv/webm),
  preferred-codec sort (-S vcodec)
- subtitles (download/embed/langs/auto), SponsorBlock (remove/mark + categories
  + force-keyframes-at-cuts), embed chapters/metadata/thumbnail, square-crop
  audio artwork
- playlist downloads: probe via `-J --flat-playlist`, inline selection UI
  (checkbox list, select-all/none, live count); each entry enqueued as its own
  single-video download, reusing the existing queue/concurrency/history
- reusable DownloadOptionsForm shared by Settings and the download bar so the
  defaults and per-download override never drift
- ROADMAP.md tracking full Seal parity (phases A-E)

Also includes in-tree security hardening that landed alongside: preload sandbox
(CJS preload output), http(s)-only window-open + blocked renderer navigation,
argv-injection guard for URLs (src/main/url.ts), extension-allowlisted file
open/reveal (src/main/reveal.ts), yt-dlp version-check timeout, and a minimal
window.electron presence marker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ROADMAP.md

@@ -0,0 +1,102 @@
+# AeroFetch Roadmap — feature parity with Seal
+
+AeroFetch is the Windows/Electron counterpart to [Seal](https://github.com/JunkFood02/Seal),
+the Android Material-You frontend for [yt-dlp](https://github.com/yt-dlp/yt-dlp). The core
+loop (probe → format pick → queue → download → history) is already in place. This document
+tracks the remaining **gap**: everything Seal does that AeroFetch doesn't yet.
+
+Sources: [Seal GitHub](https://github.com/JunkFood02/Seal) ·
+[Seal on F-Droid](https://f-droid.org/packages/com.junkfood.seal/) ·
+[It's FOSS overview](https://itsfoss.com/news/seal/).
+
+---
+
+## Already at parity ✅
+
+Video + audio download · audio → mp3 with embedded thumbnail/metadata · interactive format
+picker (probe) · quality presets · queue + concurrency cap + cancel · download history
+(open / show-in-folder) · clipboard auto-detect · light/dark theme · output folder +
+filename template · yt-dlp version check · NSIS installer + portable build.
+
+---
+
+## Phase A — Core download power ✅ COMPLETE
+
+A shared `DownloadOptions` model (`src/shared/ipc.ts`) carries the post-processing
+choices end-to-end. Persisted defaults are editable in **Settings → Format &
+post-processing** via a reusable `DownloadOptionsForm` component, which the download
+bar also hosts in a collapsible per-download **Options** panel. The main process emits
+the flags in `buildArgs` (`src/main/download.ts`). All items verified in the UI preview
+(typecheck clean). *Caveat: the option flags themselves were validated by reasoning +
+typecheck, not yet by live yt-dlp downloads — worth a real-download smoke test pass.*
+
+- [x] **Playlist downloads.** Probe now uses `yt-dlp -J --flat-playlist` and returns either
+      a single video (with formats) or a flat playlist. The download bar shows a selection
+      panel (scrollable checkbox list, select-all/none, live count) and enqueues each chosen
+      entry as its own single-video download — reusing the existing queue/concurrency/history.
+- [x] **Subtitles.** Download + embed (`--write-subs`, `--write-auto-subs`, `--sub-langs`,
+      `--embed-subs`, `--convert-subs srt`); language field + auto-caption toggle.
+- [x] **SponsorBlock.** `--sponsorblock-mark` / `--sponsorblock-remove` with a category
+      multi-select (sponsor, intro, outro, selfpromo, music_offtopic…) + `--force-keyframes-at-cuts`.
+- [x] **More audio formats.** Was mp3-only. Now best / mp3 / m4a / opus / flac / wav / aac
+      via `--audio-format`.
+- [x] **Video container + codec preference.** Container choice (mp4/mkv/webm) +
+      preferred codec (`-S res,fps,vcodec:…`) to nudge toward av1 / vp9 / h264 without
+      overriding the requested resolution.
+- [x] **Embed chapters.** `--embed-chapters` toggle. (`--split-chapters` still TODO.)
+- [x] **Embed thumbnail crop-to-square** for audio (Seal's "crop artwork") via thumbnail
+      post-processor args. *Implemented; needs a real-download smoke test of the ffmpeg crop recipe.*
+- [x] **Per-download overrides.** Collapsible Options panel in the download bar (shared
+      `DownloadOptionsForm`) so one download — or one playlist batch — can deviate from the
+      persisted defaults; "Reset to defaults" clears it. Threads `options` through
+      `addFromUrl → DownloadItem → startDownload` and is carried on retry.
+
+## Phase B — Access & networking
+
+- [ ] **Cookies.** `--cookies-from-browser <chrome|edge|firefox…>` (easy Windows win) **and**
+      a built-in login window (Electron `BrowserWindow` + session cookie export →
+      `--cookies file.txt`) — Seal's WebView cookie feature, fully doable in Electron.
+- [ ] **aria2c external downloader.** Bundle `aria2c.exe`, `--downloader aria2c
+      --downloader-args`, toggle in settings.
+- [ ] **Proxy** (`--proxy`) and **rate limit** (`--limit-rate`).
+- [ ] **Restrict filenames** toggle (`--restrict-filenames`) + optional **download archive**
+      (`--download-archive`, skip already-downloaded).
+
+## Phase C — Custom commands & yt-dlp management
+
+- [ ] **Custom command templates.** Named, editable templates of extra yt-dlp args; pick a
+      default; a "run custom command" mode. Needs persistence + a template editor view.
+- [ ] **Command preview.** Show the exact yt-dlp command line before running (build the argv
+      and render it).
+- [ ] **In-app yt-dlp updater** with stable/nightly channel (`--update-to`, or fetch the
+      release exe), surfaced next to the existing version check.
+
+## Phase D — Library, UX & notifications
+
+- [ ] **History search + multi-select + filter** (video/audio) + bulk delete + **re-download**.
+      Schema already exists in `src/shared/ipc.ts`; needs UI + likely the planned move to
+      better-sqlite3.
+- [ ] **Native OS notifications** on completion / failure (Electron `Notification`).
+- [ ] **Private / incognito mode** — a download that skips history.
+- [ ] **Backup / restore** settings + templates (export / import JSON).
+- [ ] **Error log / copy error report** view (Seal's debug report).
+
+## Phase E — Theming & platform polish
+
+Some items are Android-specific in Seal and adapted to Windows here.
+
+- [ ] **Theme presets + "follow system"** and high-contrast (toffee light/dark already exists;
+      add system-follow + a few accent presets). *Material-You dynamic color is Android-only;
+      closest Windows analog is accent presets / system accent.*
+- [ ] **i18n / language setting** (Seal ships ~40 languages). Large but optional.
+- [ ] **Windows "open with" / share integration** — register a URL-protocol handler or Explorer
+      "Send to" entry (analog of Android's share sheet). *Lower priority, platform-specific.*
+- [ ] **Onboarding / welcome screen** on first run.
+
+---
+
+## Not portable from Seal (noted for completeness)
+
+- SAF directory picker (Android storage) → already covered by the native folder dialog.
+- Android share-sheet / quick-download-on-share → partially mapped to Phase E.
+- F-Droid distribution → N/A (AeroFetch ships NSIS + portable).