fix(anime): scope preferences, paginate sources, harden installs

- Preference store keys entries by extension package + bridge source id; legacy unscoped entries are discarded once instead of being handed to whichever extension asks first
- Source picker's "Load more" appends the next page without duplicating streamed results
- Repository index fetches and subtitle/APK downloads now time out and are size-bounded instead of hanging or growing unbounded
- APK installs are staged to a temp file and renamed into place
- Stream metadata lookup matches the requested path, not only the currently playing one
- Reworked animeui into browse-state/detail-panel/panels.css modules
- Reverted premature CHANGELOG unreleased entries; refreshed anime-browser docs

src/anime-bridge/extension-repo.ts

@@ -115,8 +115,12 @@ export function parseRepoIndex(indexUrl: string, payload: unknown): RepoExtensio
 export interface FetchRepoOptions {
   fetchImpl?: typeof fetch;
   signal?: AbortSignal;
+  /** Applied when no signal is supplied, so one stalled repo cannot block the catalogue. */
+  timeoutMs?: number;
 }
 
+const DEFAULT_REPO_TIMEOUT_MS = 15_000;
+
 /** Fetch and parse one repository index. */
 export async function fetchRepoIndex(
   indexUrl: string,
@@ -126,9 +130,11 @@ export async function fetchRepoIndex(
     throw new Error(`Not a valid repository index URL: ${indexUrl}`);
   }
   const fetchImpl = options.fetchImpl ?? fetch;
+  const signal =
+    options.signal ?? AbortSignal.timeout(options.timeoutMs ?? DEFAULT_REPO_TIMEOUT_MS);
   const response = await fetchImpl(indexUrl.trim(), {
     headers: { Accept: 'application/json' },
-    ...(options.signal ? { signal: options.signal } : {}),
+    signal,
   });
   if (!response.ok) {
     throw new Error(`Repository returned ${response.status} for ${indexUrl}`);