fix: address codebase review issues

- refactor(backend): use tokio::sync::Mutex for DbState and update commands to async
- fix(backend): remove unconditional post-queue system action in scheduler
- refactor(backend): remove dead WebSocket aria2 progress loop
- fix(backend): use character count for deep link payload length check
- fix(backend): implement dynamic port fallback for extension server
- build(backend): apply macos codesigning step for release builds
- security(backend): add explicitly defined Content-Security-Policy
- fix(frontend): replace pause_download API call with remove_download for file cleanup
- fix(frontend): resolve bug ignoring 0% progress reporting
- fix(frontend): append instead of overwrite deep link URLs when Add Modal is open
- style(frontend): append standard .dark class for dark mode themes
- style(frontend): remove ghost row layout hack from download table
- build: decouple typescript binding generation from build step

src-tauri/src/extension_server.rs

@@ -81,9 +81,16 @@ pub async fn start_server(
         .layer(cors)
         .with_state(state);
 
-    let listener = tokio::net::TcpListener::bind(("127.0.0.1", EXTENSION_SERVER_PORT))
-        .await
-        .map_err(|e| format!("Failed to bind to {}: {}", EXTENSION_SERVER_PORT, e))?;
+    let mut listener = None;
+    for port in EXTENSION_SERVER_PORT..=(EXTENSION_SERVER_PORT + 10) {
+        if let Ok(l) = tokio::net::TcpListener::bind(("127.0.0.1", port)).await {
+            listener = Some((l, port));
+            break;
+        }
+    }
+
+    let (listener, bound_port) = listener.ok_or_else(|| "Failed to bind extension server to any port".to_string())?;
+    println!("Browser extension server bound to 127.0.0.1:{}", bound_port);
 
     axum::serve(listener, app)
         .await