feat(portable): add secure Windows portable release (#15)

Implement marker-based portable storage, portable WebView and log paths, secure queue and migration sanitization, and Windows portable ZIP validation while preserving the NSIS installer path.

Refs #15

src/utils/downloads.ts

@@ -121,11 +121,10 @@ const DOWNLOAD_SECRET_FIELDS = ['password', 'cookies', 'headers'] as const;
  * progress fields (`fraction`, `speed`, `eta`) are also dropped as in the
  * existing persistence path.
  *
- * Note: `url` is intentionally retained even though it may contain signed
- * query parameters — redacting it would break resume/retry since the URL is
- * the download source. Ad-hoc credentials entered in the Add Downloads modal
- * are therefore session-scoped; site-login passwords (Keychain-backed) are
- * unaffected by this redaction.
+ * Note: standard persistence intentionally retains `url` because it is the
+ * download source. The backend applies a stricter portable-mode policy: URL
+ * userinfo, query, and fragment components are removed before portable data
+ * is written, and affected active records are not auto-resumed.
  */
 export const redactDownloadForPersistence = (item: DownloadItem): DownloadItem => {
   const copy: DownloadItem = { ...item };

src/utils/platform.ts

@@ -5,7 +5,8 @@ import { invokeCommand as invoke } from '../ipc';
 const fallback: PlatformInfo = {
   os: 'unknown',
   arch: 'unknown',
-  targetTriple: 'unknown'
+  targetTriple: 'unknown',
+  portable: false
 };
 
 let cached: PlatformInfo | null = null;