fix(settings): harden Torrent network validation

- Align the DHT message-timeout range with bundled Aria2 1.37.0.
- Validate and canonicalize Torrent network text settings at the native boundary.
- Fence delayed input responses and reject contradictory IPv6 bind state.
- Add regression coverage for malformed settings and cross-field races.

src/utils/downloads.ts

@@ -81,7 +81,8 @@ export const MIN_TORRENT_MAX_OPEN_FILES = 1;
 export const MAX_TORRENT_MAX_OPEN_FILES = 4096;
 export const DEFAULT_TORRENT_DHT_MESSAGE_TIMEOUT = 10;
 export const MIN_TORRENT_DHT_MESSAGE_TIMEOUT = 1;
-export const MAX_TORRENT_DHT_MESSAGE_TIMEOUT = 600;
+// Aria2 1.37.0 accepts DHT message timeouts only from 1 through 60 seconds.
+export const MAX_TORRENT_DHT_MESSAGE_TIMEOUT = 60;
 export const DEFAULT_TORRENT_MAX_CONCURRENT_SEEDS = 2;
 export const MIN_TORRENT_MAX_CONCURRENT_SEEDS = 1;
 export const MAX_TORRENT_MAX_CONCURRENT_SEEDS = 64;

src/utils/torrentNetworkInput.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, it } from 'vitest';
+import { shouldApplyTorrentNetworkInputResult } from './torrentNetworkInput';
+
+describe('Torrent network input request fencing', () => {
+  it('rejects a response from an older request', () => {
+    expect(shouldApplyTorrentNetworkInputResult(1, 2, 4, 4)).toBe(false);
+  });
+
+  it('rejects a response after the user edits the draft', () => {
+    expect(shouldApplyTorrentNetworkInputResult(2, 2, 3, 4)).toBe(false);
+  });
+
+  it('accepts only the current request for the current draft', () => {
+    expect(shouldApplyTorrentNetworkInputResult(3, 3, 5, 5)).toBe(true);
+  });
+});

src/utils/torrentNetworkInput.ts

@@ -0,0 +1,6 @@
+export const shouldApplyTorrentNetworkInputResult = (
+  requestId: number,
+  currentRequestId: number,
+  editRequestId: number,
+  currentEditId: number
+): boolean => requestId === currentRequestId && editRequestId === currentEditId;