Comprehensive bugfix release v1.6.45

Fix ~70 issues across the entire codebase including security fixes,
error handling improvements, test stabilization, and code quality.

- Fix TLS race condition with reference-counted acquire/release
- Bind debug server to 127.0.0.1 instead of 0.0.0.0
- Add overall timeout to MegaWebFallback
- Stream update installer to disk instead of RAM buffering
- Add path traversal protection in JVM extractor
- Cache DdownloadClient with credential-based invalidation
- Add .catch() to all fire-and-forget IPC calls
- Wrap app startup, clipboard, session-log in try/catch
- Add timeouts to container.ts fetch calls
- Fix variable shadowing, tsconfig path, line endings
- Stabilize tests with proper cleanup and timing tolerance
- Fix installer privileges, scripts, and afterPack null checks
- Delete obsolete _upload_release.mjs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/debrid_service_smoke.ts

@@ -31,18 +31,21 @@ async function main(): Promise<void> {
     login: settings.megaLogin,
     password: settings.megaPassword
   }));
-  const service = new DebridService(settings, {
-    megaWebUnrestrict: (link) => megaWeb.unrestrict(link)
-  });
-  for (const link of links) {
-    try {
-      const result = await service.unrestrictLink(link);
-      console.log(`[OK] ${result.providerLabel} -> ${result.fileName}`);
-    } catch (error) {
-      console.log(`[FAIL] ${String(error)}`);
+  try {
+    const service = new DebridService(settings, {
+      megaWebUnrestrict: (link) => megaWeb.unrestrict(link)
+    });
+    for (const link of links) {
+      try {
+        const result = await service.unrestrictLink(link);
+        console.log(`[OK] ${result.providerLabel} -> ${result.fileName}`);
+      } catch (error) {
+        console.log(`[FAIL] ${String(error)}`);
+      }
     }
+  } finally {
+    megaWeb.dispose();
   }
-  megaWeb.dispose();
 }
 
-void main();
+main().catch(e => { console.error(e); process.exit(1); });