feat(debrid): add HTTPS downloader for debrid direct URLs

DebridDownloader receives directUrl from the server and downloads via
plain HTTPS with progress reporting, resume (Range), and pause/cancel.

- Add DirectURL, DirectFileName to agent Task and engine Task types
- Implement DebridDownloader: HTTPS download with progress, resume, cancel
- HTTP client with 30s ResponseHeaderTimeout
- Safe shortID helper to prevent slice panic on short IDs
- Validate 416 against Content-Range server size for resume integrity
- Register debridDl in daemon and one-shot download command
- Tests: available, download, resume, cancel, pause, fallback filename,
  expired URL (410), unauthorized (401), shutdown, task propagation

internal/cmd/download.go

@@ -88,6 +88,8 @@ func runDownload(input, method string) error {
 		5*time.Second,
 	)
 
+	debridDl := engine.NewDebridDownloader()
+
 	manager := engine.NewManager(engine.ManagerConfig{
 		MaxConcurrent: 1,
 		OutputDir:     outputDir,
@@ -96,7 +98,7 @@ func runDownload(input, method string) error {
 			MoviesDir:  cfg.Organize.MoviesDir,
 			TVShowsDir: cfg.Organize.TVShowsDir,
 		},
-	}, reporter, torrentDl)
+	}, reporter, torrentDl, debridDl)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()