feat(setup): fetch ffmpeg on first run instead of bundling it

Ship a smaller installer that no longer carries ffmpeg.exe/ffprobe.exe
(the bulk of its size). On first run they are downloaded from a pinned
upstream archive (gyan 8.1.2), verified against a pinned SHA-256, and
unpacked with the OS tar.exe into the managed userData/bin dir -- the
same place as the self-updating yt-dlp, so they survive app updates and
portable re-extraction. A hard onboarding gate blocks the app until they
are present, with a "locate existing ffmpeg" folder-picker fallback for
offline machines and a Repair action in Settings > About.

The updater's streaming/checksum/redirect/idle-timeout download loop is
extracted to lib/verifiedDownload.streamVerifiedFile and shared by both
the app-installer download and the ffmpeg fetch; the updater's public
behaviour and error strings are unchanged (its boundary tests still pass).
No new npm dependency: extraction uses the System32 bsdtar resolved by
absolute path (audit F3).

Note: this commit also carries pre-existing, in-progress aria2c/network
and updater-token work that was already uncommitted in the working tree
and is entangled with the above in shared files (updater.ts, ipc.ts,
preload/index.ts, mockApi.ts, shared/ipc.ts, plus the settings/network
files and aria2c.exe). It was not cleanly separable by path, so it is
included here rather than split out.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

electron-builder.yml

@@ -28,13 +28,19 @@ files:
   - '!{tsconfig.json,tsconfig.node.json,tsconfig.web.json}'
   - '!*.tsbuildinfo'
 
-# yt-dlp.exe + ffmpeg.exe ship outside the asar archive so they can be spawned
-# directly. They land in <install>/resources/bin, reachable via process.resourcesPath.
+# yt-dlp.exe (+ optional aria2c.exe) ship outside the asar archive so they can be spawned
+# directly, landing in <install>/resources/bin (reachable via process.resourcesPath).
+# ffmpeg.exe/ffprobe.exe are deliberately EXCLUDED — they're the bulk of the installer, so
+# they're fetched on first run into userData/bin instead (src/main/ffmpegSetup.ts). The
+# excludes also keep a developer's local resources/bin copies (used only for the dev seed)
+# out of the shipped build.
 extraResources:
   - from: resources/bin
     to: bin
     filter:
       - '**/*'
+      - '!ffmpeg.exe'
+      - '!ffprobe.exe'
   # The app icon, copied so the runtime (system tray) can load it at
   # <resources>/icon.ico — build/ itself isn't bundled into the app.
   - from: build/icon.ico