Security hardening, renderer modularization, and stability improvements

Renderer Architecture

• Migrated the renderer from a single bundled file to a modular ES module architecture.
• Added new source files for core logic, UI components, managers, and services under src/renderer/.
• Updated index.html to load the new renderer entry point as a module.
• Renamed the old renderer.js to renderer.js.backup for reference.

Security

• Improved error logging in main.js for file and directory access failures.
• XSS protections:
  • Added HTML escaping in renderer.js.
  • Escaped text in button rendering to prevent injection.
• Added stricter validation helpers in security.js:
  • validateCommandArgsOrThrow
  • validatePathOrThrow
• Enforced URL protocol allowlist (http/https) in the download manager and main-process IPC handlers.
• Improved file path validation for installer execution.
• Password manager crypto updates:
  • Updated key derivation to use crypto.hkdfSync.
  • Replaced hkdfSync usage in password-manager/auth.js with a manual HKDF (HMAC-SHA256) implementation for better compatibility.

Stability and Maintenance

• Refactored updater cache cleanup to async operations and improved concurrent access handling.
• Added tracking and cleanup of temporary files created during replace-exe operations.
• Improved robustness in EXE selection logic and ensured fallback behavior.
• Improved download-manager cleanup logic.
• Fixed a race condition in OAuth window resolution.

UI and CSP

• Moved theme initialization to an external script and removed 'unsafe-inline' from script-src in index.html.
• Moved title bar initialization and event handling to src/config/titlebar-init.js.
• Updated index.html to use button IDs instead of inline onclick handlers.

Database and IPC

• Introduced a singleton PasswordManagerDB to prevent connection exhaustion.
• Updated relevant IPC handlers to use the singleton.