Comprehensive bugfix release v1.6.45

Fix ~70 issues across the entire codebase including security fixes,
error handling improvements, test stabilization, and code quality.

- Fix TLS race condition with reference-counted acquire/release
- Bind debug server to 127.0.0.1 instead of 0.0.0.0
- Add overall timeout to MegaWebFallback
- Stream update installer to disk instead of RAM buffering
- Add path traversal protection in JVM extractor
- Cache DdownloadClient with credential-based invalidation
- Add .catch() to all fire-and-forget IPC calls
- Wrap app startup, clipboard, session-log in try/catch
- Add timeouts to container.ts fetch calls
- Fix variable shadowing, tsconfig path, line endings
- Stabilize tests with proper cleanup and timing tolerance
- Fix installer privileges, scripts, and afterPack null checks
- Delete obsolete _upload_release.mjs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/main/debrid.ts

@@ -1154,6 +1154,9 @@ export class DebridService {
 
   private options: DebridServiceOptions;
 
+  private cachedDdownloadClient: DdownloadClient | null = null;
+  private cachedDdownloadKey = "";
+
   public constructor(settings: AppSettings, options: DebridServiceOptions = {}) {
     this.settings = cloneSettings(settings);
     this.options = options;
@@ -1163,6 +1166,16 @@ export class DebridService {
     this.settings = cloneSettings(next);
   }
 
+  private getDdownloadClient(login: string, password: string): DdownloadClient {
+    const key = `${login}\0${password}`;
+    if (this.cachedDdownloadClient && this.cachedDdownloadKey === key) {
+      return this.cachedDdownloadClient;
+    }
+    this.cachedDdownloadClient = new DdownloadClient(login, password);
+    this.cachedDdownloadKey = key;
+    return this.cachedDdownloadClient;
+  }
+
   public async resolveFilenames(
     links: string[],
     onResolved?: (link: string, fileName: string) => void,
@@ -1338,7 +1351,7 @@ export class DebridService {
       return new AllDebridClient(settings.allDebridToken).unrestrictLink(link, signal);
     }
     if (provider === "ddownload") {
-      return new DdownloadClient(settings.ddownloadLogin, settings.ddownloadPassword).unrestrictLink(link, signal);
+      return this.getDdownloadClient(settings.ddownloadLogin, settings.ddownloadPassword).unrestrictLink(link, signal);
     }
     return new BestDebridClient(settings.bestToken).unrestrictLink(link, signal);
   }