fix(anime): harden the extension bridge against untrusted repos and hangs

Addresses CodeRabbit review feedback on the Anime Browser:

- reject repository package/apk names that are not plain identifiers, and
  verify the install target resolves inside the extensions directory
- count mpv's %n% option escape in UTF-8 bytes, and escape backslashes in
  header values so a trailing one cannot eat the list separator
- key the bridge extension-id cache by APK content, so an in-place upgrade
  re-uploads instead of running the previous build
- bound every bridge, release-listing, and download request with a timeout
- enforce the APK size limit while streaming rather than after buffering
- read APK bytes on demand instead of holding a base64 copy per extension
  for the lifetime of the browser
- serialize preference mutations and write the file atomically
- handle the sidecar spawn error event, and wait for the child to exit in
  stop() before returning
- report a failed Anime Browser bootstrap instead of showing the starting
  banner forever
- keep the preferences panel's save confirmation and in-flight multi-select
  edits by re-rendering only on a structural schema change

src/anime-bridge/headers.test.ts

@@ -28,6 +28,13 @@ test('toMpvHeaderFields joins entries and escapes commas in values', () => {
   assert.equal(fields, 'Referer: https://origin.example/,Cookie: a=1\\, b=2');
 });
 
+test('toMpvHeaderFields escapes backslashes so a trailing one cannot eat the separator', () => {
+  const fields = toMpvHeaderFields({ Referer: 'https://origin.example/path\\', Cookie: 'a=1' });
+  // Without doubling, the value's trailing backslash would escape the comma
+  // and merge Cookie into the Referer entry.
+  assert.equal(fields, 'Referer: https://origin.example/path\\\\,Cookie: a=1');
+});
+
 test('toMpvHeaderFields returns an empty string when there are no headers', () => {
   assert.equal(toMpvHeaderFields({}), '');
 });