Comprehensive bugfix release v1.6.45

Fix ~70 issues across the entire codebase including security fixes,
error handling improvements, test stabilization, and code quality.

- Fix TLS race condition with reference-counted acquire/release
- Bind debug server to 127.0.0.1 instead of 0.0.0.0
- Add overall timeout to MegaWebFallback
- Stream update installer to disk instead of RAM buffering
- Add path traversal protection in JVM extractor
- Cache DdownloadClient with credential-based invalidation
- Add .catch() to all fire-and-forget IPC calls
- Wrap app startup, clipboard, session-log in try/catch
- Add timeouts to container.ts fetch calls
- Fix variable shadowing, tsconfig path, line endings
- Stabilize tests with proper cleanup and timing tolerance
- Fix installer privileges, scripts, and afterPack null checks
- Delete obsolete _upload_release.mjs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/main/extractor.ts

@@ -62,6 +62,26 @@ function removeSubstMapping(mapping: SubstMapping): void {
   logger.info(`subst ${mapping.drive}: entfernt`);
 }
 
+export function cleanupStaleSubstDrives(): void {
+  if (process.platform !== "win32") return;
+  try {
+    const result = spawnSync("subst", [], { stdio: "pipe", timeout: 5000 });
+    const output = String(result.stdout || "");
+    for (const line of output.split("\n")) {
+      const match = line.match(/^([A-Z]):\\: => (.+)/i);
+      if (!match) continue;
+      const drive = match[1].toUpperCase();
+      const target = match[2].trim();
+      if (/\\rd-extract-|\\Real-Debrid-Downloader/i.test(target)) {
+        spawnSync("subst", [`${drive}:`, "/d"], { stdio: "pipe", timeout: 5000 });
+        logger.info(`Stale subst ${drive}: entfernt (${target})`);
+      }
+    }
+  } catch {
+    // ignore — subst cleanup is best-effort
+  }
+}
+
 let resolvedExtractorCommand: string | null = null;
 let resolveFailureReason = "";
 let resolveFailureAt = 0;