fix(security): address v0.7.0 security audit vulnerabilities

- fix(media): use temp config file for yt-dlp credentials
- fix(rpc): exclude rpcSecret and rpcPort from serialization
- fix(ssrf): validate private hosts for all fetches
- fix(uri): add rate limiting to firelink scheme
- fix(auth): implement HMAC-SHA256 request signing for LocalExtensionServer
- fix(fs): prevent path traversal during file deletion
- fix(fs): apply strict 0o600 permissions to aria2.conf
- fix(crypto): remove insecure UUID fallback for pairing token
- fix(http): strip CRLF characters from custom headers
- fix(network): use POSIX socket to eliminate port-finding race window
- fix(ui): limit text input lengths in Add Downloads view
- fix(concurrency): implement thread-safe temp directory cleanup
- feat(ui): modernize sidebar and download table components

Sources/Firelink/FirelinkApp.swift

@@ -7,6 +7,8 @@ struct FirelinkApp: App {
     @StateObject private var controller: DownloadController
     @StateObject private var schedulerController: SchedulerController
     @AppStorage("showMenuBarIcon") private var showMenuBarIcon = true
+    @State private var lastURLSchemeInvocation: Date = .distantPast
+    @State private var urlSchemeInvocationCount: Int = 0
 
     // Server must be retained to keep listening
     private let extensionServer: LocalExtensionServer?
@@ -38,11 +40,20 @@ struct FirelinkApp: App {
                     updateChecker.checkAutomaticallyIfNeeded()
                 }
                 .onOpenURL { url in
+                    let now = Date()
+                    if now.timeIntervalSince(lastURLSchemeInvocation) > 5 {
+                        urlSchemeInvocationCount = 0
+                    }
+                    guard urlSchemeInvocationCount < 3 else { return }
+                    urlSchemeInvocationCount += 1
+                    lastURLSchemeInvocation = now
+
                     if url.scheme == "firelink" {
                         if url.host == "add",
                            let components = URLComponents(url: url, resolvingAgainstBaseURL: false),
                            let queryItems = components.queryItems,
-                           let link = queryItems.first(where: { $0.name == "url" })?.value {
+                           let link = queryItems.first(where: { $0.name == "url" })?.value,
+                           link.count < 65536 {
                             DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
                                 controller.pendingPasteboardText = link
                                 controller.pendingReferer = nil
@@ -52,6 +63,7 @@ struct FirelinkApp: App {
                         return
                     }
                     
+                    guard url.absoluteString.count < 65536 else { return }
                     DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
                         controller.pendingPasteboardText = url.absoluteString
                         controller.pendingReferer = nil