fix(security): resolve all medium severity vulnerabilities

- Ensure yt-dlp partial files are cleaned up on error exits.
- Handle Semaphore closure gracefully without panicking.
- Replace busy-polling in wait_permit_released with Notify.
- Fix extension server silent failure with retry loop and logging.
- Ignore malformed existing scheduler settings instead of failing.
- Add final symlink checks before revealing/opening downloads.
- Delay listener registration in App.tsx until core is ready.
- Sanitize Referer header to prevent injection.

src/App.tsx

@@ -513,6 +513,7 @@ function App() {
   }, [theme]);
 
   useEffect(() => {
+    if (!coreReady) return;
     const unlistenDownload = initDownloadListener();
 
     const unlistenTerminalState = listen('download-state', (event) => {
@@ -571,7 +572,7 @@ function App() {
       unlistenDeepLink.then(f => f());
       unlistenDownload.then(f => { if (f) f(); });
     };
-  }, []);
+  }, [coreReady]);
 
   return (
     <div className="app-shell flex h-screen w-screen overflow-hidden text-text-primary">

src/components/AddDownloadsModal.tsx

@@ -107,7 +107,7 @@ export const AddDownloadsModal = () => {
       setChecksumAlgo('SHA-256');
       setChecksumValue('');
       setHeaders([
-        pendingAddReferer ? `Referer: ${pendingAddReferer}` : '',
+        pendingAddReferer ? `Referer: ${pendingAddReferer.replace(/[\r\n]/g, '')}` : '',
         pendingAddHeaders
       ].filter(Boolean).join('\n'));
       setCookies(pendingAddCookies);