Comprehensive bugfix release v1.6.45

Fix ~70 issues across the entire codebase including security fixes,
error handling improvements, test stabilization, and code quality.

- Fix TLS race condition with reference-counted acquire/release
- Bind debug server to 127.0.0.1 instead of 0.0.0.0
- Add overall timeout to MegaWebFallback
- Stream update installer to disk instead of RAM buffering
- Add path traversal protection in JVM extractor
- Cache DdownloadClient with credential-based invalidation
- Add .catch() to all fire-and-forget IPC calls
- Wrap app startup, clipboard, session-log in try/catch
- Add timeouts to container.ts fetch calls
- Fix variable shadowing, tsconfig path, line endings
- Stabilize tests with proper cleanup and timing tolerance
- Fix installer privileges, scripts, and afterPack null checks
- Delete obsolete _upload_release.mjs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/auto-rename.test.ts

@@ -269,6 +269,7 @@ describe("buildAutoRenameBaseName", () => {
     const result = buildAutoRenameBaseName("Show.S99.720p-4sf", "show.s99e999.720p.mkv");
     // SCENE_EPISODE_RE allows up to 3-digit episodes and 2-digit seasons
     expect(result).not.toBeNull();
+    expect(result!).toContain("S99E999");
   });
 
   // Real-world scene release patterns
@@ -343,6 +344,7 @@ describe("buildAutoRenameBaseName", () => {
     const result = buildAutoRenameBaseName("Show.S01-4sf", "show.s01e01.mkv");
     // "mkv" should not be treated as part of the filename match
     expect(result).not.toBeNull();
+    expect(result!).toContain("S01E01");
   });
 
   it("does not match episode-like patterns in codec strings", () => {
@@ -373,6 +375,7 @@ describe("buildAutoRenameBaseName", () => {
     // Extreme edge case - sanitizeFilename trims leading dots
     expect(result).not.toBeNull();
     expect(result!).toContain("S01E01");
+    expect(result!).toContain("-4sf");
     expect(result!).not.toContain(".S01E01.S01E01"); // no duplication
   });