feat(setup): fetch ffmpeg on first run instead of bundling it

Ship a smaller installer that no longer carries ffmpeg.exe/ffprobe.exe
(the bulk of its size). On first run they are downloaded from a pinned
upstream archive (gyan 8.1.2), verified against a pinned SHA-256, and
unpacked with the OS tar.exe into the managed userData/bin dir -- the
same place as the self-updating yt-dlp, so they survive app updates and
portable re-extraction. A hard onboarding gate blocks the app until they
are present, with a "locate existing ffmpeg" folder-picker fallback for
offline machines and a Repair action in Settings > About.

The updater's streaming/checksum/redirect/idle-timeout download loop is
extracted to lib/verifiedDownload.streamVerifiedFile and shared by both
the app-installer download and the ffmpeg fetch; the updater's public
behaviour and error strings are unchanged (its boundary tests still pass).
No new npm dependency: extraction uses the System32 bsdtar resolved by
absolute path (audit F3).

Note: this commit also carries pre-existing, in-progress aria2c/network
and updater-token work that was already uncommitted in the working tree
and is entangled with the above in shared files (updater.ts, ipc.ts,
preload/index.ts, mockApi.ts, shared/ipc.ts, plus the settings/network
files and aria2c.exe). It was not cleanly separable by path, so it is
included here rather than split out.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/index.ts

@@ -10,6 +10,7 @@ import {
   getSystemThemeInfo
 } from './ipc'
 import { runStartupYtdlpAutoUpdate } from './ytdlp'
+import { ensureManagedFfmpeg } from './ffmpegSetup'
 import { hasActiveDownloads } from './download'
 import { getSettings, applyLaunchAtStartup, migrateSecretsAtRest } from './settings'
 import { ensureMediaDirs } from './paths'
@@ -311,6 +312,12 @@ if (isPrimaryInstance) {
       }
     ])
 
+    // Seed the managed ffmpeg/ffprobe from the dev bundle when present, so a dev checkout
+    // (and any transitional build that still ships them) is ready without a download. In a
+    // shipped installer there's no seed, so this no-ops and the renderer's setup gate
+    // triggers the first-run download instead. Cheap + best-effort.
+    ensureManagedFfmpeg()
+
     // Keep yt-dlp current on its own: seed the managed copy, then (throttled to
     // once a day) self-update it to the chosen channel so a stale binary can't
     // silently cause YouTube 403s. Best-effort and off the critical path — it