Comprehensive bugfix release v1.6.45

Fix ~70 issues across the entire codebase including security fixes,
error handling improvements, test stabilization, and code quality.

- Fix TLS race condition with reference-counted acquire/release
- Bind debug server to 127.0.0.1 instead of 0.0.0.0
- Add overall timeout to MegaWebFallback
- Stream update installer to disk instead of RAM buffering
- Add path traversal protection in JVM extractor
- Cache DdownloadClient with credential-based invalidation
- Add .catch() to all fire-and-forget IPC calls
- Wrap app startup, clipboard, session-log in try/catch
- Add timeouts to container.ts fetch calls
- Fix variable shadowing, tsconfig path, line endings
- Stabilize tests with proper cleanup and timing tolerance
- Fix installer privileges, scripts, and afterPack null checks
- Delete obsolete _upload_release.mjs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/provider_smoke_check.mjs

@@ -66,6 +66,8 @@ async function callRealDebrid(link) {
   };
 }
 
+// megaCookie is intentionally cached at module scope so that multiple
+// callMegaDebrid() invocations reuse the same session cookie.
 async function callMegaDebrid(link) {
   if (!megaCookie) {
     const loginRes = await fetch("https://www.mega-debrid.eu/index.php?form=login", {
@@ -77,13 +79,15 @@ async function callMegaDebrid(link) {
       body: new URLSearchParams({ login: megaLogin, password: megaPassword, remember: "on" }),
       redirect: "manual"
     });
-    megaCookie = (loginRes.headers.get("set-cookie") || "")
-      .split(",")
+    if (loginRes.status >= 400) {
+      return { ok: false, error: `Mega-Web login failed with HTTP ${loginRes.status}` };
+    }
+    megaCookie = loginRes.headers.getSetCookie()
       .map((chunk) => chunk.split(";")[0].trim())
       .filter(Boolean)
       .join("; ");
     if (!megaCookie) {
-      return { ok: false, error: "Mega-Web login failed" };
+      return { ok: false, error: "Mega-Web login returned no session cookie" };
     }
   }
 
@@ -290,4 +294,4 @@ async function main() {
   }
 }
 
-await main();
+await main().catch((e) => { console.error(e); process.exit(1); });