🐛 fix: job index rebuild after restore, drop-target visibility, XSS

- Rebuild _jobIndexById after restoring queue from config on startup
  (prevented progress updates from finding restored jobs)
- Show and focus mainWindow when files are dropped on floating
  drop-target while window is minimized/hidden
- Escape status text in queue table HTML to prevent XSS from
  unexpected status values

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

main.js

@@ -1259,6 +1259,10 @@ ipcMain.handle('hide-drop-target', () => {
 
 ipcMain.on('drop-target:files', (_event, paths) => {
   if (mainWindow && !mainWindow.isDestroyed()) {
+    if (!mainWindow.isVisible() || mainWindow.isMinimized()) {
+      mainWindow.show();
+      mainWindow.focus();
+    }
     mainWindow.webContents.send('drop-target:files', paths);
   }
 });

renderer/app.js

@@ -408,6 +408,7 @@ function restoreQueueStateFromConfig() {
     }
   }
   queueJobs = Array.from(seen.values());
+  rebuildJobIndex();
 }
 
 function buildPersistedQueueState() {
@@ -750,7 +751,7 @@ function buildRowHtml(job) {
     <td class="col-filename" title="${escapeAttr(job.fileName)}">${escapeHtml(job.fileName)}</td>
     <td class="col-size">${uploadedSize}</td>
     <td class="col-host">${escapeHtml(job.hoster)}</td>
-    <td class="col-status"><span class="status-badge ${statusClass}">${statusText}</span></td>
+    <td class="col-status"><span class="status-badge ${statusClass}">${escapeHtml(statusText)}</span></td>
     <td class="col-elapsed">${elapsed}</td>
     <td class="col-remaining">${remaining}</td>
     <td class="col-speed">${speed}</td>