fix(anime): harden the extension bridge against untrusted repos and hangs

Addresses CodeRabbit review feedback on the Anime Browser:

- reject repository package/apk names that are not plain identifiers, and
  verify the install target resolves inside the extensions directory
- count mpv's %n% option escape in UTF-8 bytes, and escape backslashes in
  header values so a trailing one cannot eat the list separator
- key the bridge extension-id cache by APK content, so an in-place upgrade
  re-uploads instead of running the previous build
- bound every bridge, release-listing, and download request with a timeout
- enforce the APK size limit while streaming rather than after buffering
- read APK bytes on demand instead of holding a base64 copy per extension
  for the lifetime of the browser
- serialize preference mutations and write the file atomically
- handle the sidecar spawn error event, and wait for the child to exit in
  stop() before returning
- report a failed Anime Browser bootstrap instead of showing the starting
  banner forever
- keep the preferences panel's save confirmation and in-flight multi-select
  edits by re-rendering only on a structural schema change

src/anime-bridge/extension-repo.test.ts

@@ -87,6 +87,26 @@ test('malformed entries are skipped rather than failing the repo', () => {
   assert.equal(parsed.length, 1);
 });
 
+test('a package name that is not a plain identifier is rejected', () => {
+  // The package name becomes the on-disk file name, and a repo index is
+  // unauthenticated: path separators here would write outside the extensions
+  // directory even though the prefix check passes.
+  const parsed = parseRepoIndex(INDEX, [
+    animeEntry({ pkg: 'eu.kanade.tachiyomi.animeextension/../../../../etc/cron.d/x' }),
+    animeEntry({ pkg: 'eu.kanade.tachiyomi.animeextension\\..\\evil' }),
+    animeEntry({ pkg: 'eu.kanade.tachiyomi.animeextension.all.ok' }),
+  ]);
+  assert.deepEqual(
+    parsed.map((extension) => extension.pkg),
+    ['eu.kanade.tachiyomi.animeextension.all.ok'],
+  );
+});
+
+test('an apk file name with path characters is rejected', () => {
+  const parsed = parseRepoIndex(INDEX, [animeEntry({ apk: '../../../etc/passwd' })]);
+  assert.deepEqual(parsed, []);
+});
+
 test('parseRepoIndex tolerates a non-array payload', () => {
   assert.deepEqual(parseRepoIndex(INDEX, { message: 'Not Found' }), []);
   assert.deepEqual(parseRepoIndex(INDEX, null), []);