Comprehensive bugfix release v1.6.45

Fix ~70 issues across the entire codebase including security fixes,
error handling improvements, test stabilization, and code quality.

- Fix TLS race condition with reference-counted acquire/release
- Bind debug server to 127.0.0.1 instead of 0.0.0.0
- Add overall timeout to MegaWebFallback
- Stream update installer to disk instead of RAM buffering
- Add path traversal protection in JVM extractor
- Cache DdownloadClient with credential-based invalidation
- Add .catch() to all fire-and-forget IPC calls
- Wrap app startup, clipboard, session-log in try/catch
- Add timeouts to container.ts fetch calls
- Fix variable shadowing, tsconfig path, line endings
- Stabilize tests with proper cleanup and timing tolerance
- Fix installer privileges, scripts, and afterPack null checks
- Delete obsolete _upload_release.mjs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/main/container.ts

@@ -164,7 +164,7 @@ async function decryptDlcLocal(filePath: string): Promise<ParsedPackageInput[]>
   const dlcData = content.slice(0, -88);
 
   const rcUrl = DLC_SERVICE_URL.replace("{KEY}", encodeURIComponent(dlcKey));
-  const rcResponse = await fetch(rcUrl, { method: "GET" });
+  const rcResponse = await fetch(rcUrl, { method: "GET", signal: AbortSignal.timeout(30000) });
   if (!rcResponse.ok) {
     return [];
   }
@@ -217,7 +217,8 @@ async function tryDcryptUpload(fileContent: Buffer, fileName: string): Promise<s
 
   const response = await fetch(DCRYPT_UPLOAD_URL, {
     method: "POST",
-    body: form
+    body: form,
+    signal: AbortSignal.timeout(30000)
   });
   if (response.status === 413) {
     return null;
@@ -235,7 +236,8 @@ async function tryDcryptPaste(fileContent: Buffer): Promise<string[] | null> {
 
   const response = await fetch(DCRYPT_PASTE_URL, {
     method: "POST",
-    body: form
+    body: form,
+    signal: AbortSignal.timeout(30000)
   });
   if (response.status === 413) {
     return null;