fix(security): resolve all medium severity vulnerabilities

- Ensure yt-dlp partial files are cleaned up on error exits.
- Handle Semaphore closure gracefully without panicking.
- Replace busy-polling in wait_permit_released with Notify.
- Fix extension server silent failure with retry loop and logging.
- Ignore malformed existing scheduler settings instead of failing.
- Add final symlink checks before revealing/opening downloads.
- Delay listener registration in App.tsx until core is ready.
- Sanitize Referer header to prevent injection.

src/components/AddDownloadsModal.tsx

@@ -107,7 +107,7 @@ export const AddDownloadsModal = () => {
       setChecksumAlgo('SHA-256');
       setChecksumValue('');
       setHeaders([
-        pendingAddReferer ? `Referer: ${pendingAddReferer}` : '',
+        pendingAddReferer ? `Referer: ${pendingAddReferer.replace(/[\r\n]/g, '')}` : '',
         pendingAddHeaders
       ].filter(Boolean).join('\n'));
       setCookies(pendingAddCookies);