test: add comprehensive test suite for engine, agent and cmd packages

- Refactor download.go and stream.go with downloadDeps/streamDeps structs
  for dependency injection, enabling unit testing without real I/O
- download_test.go: 15 tests — input validation, mock downloaders, method
  selection, cobra Args, deadlock detection
- stream_test.go: input validation, noOpen flag, engine error handling
- client_test.go: context cancellation, timeout, full Sync roundtrip,
  watch-progress and HTTP error unwrapping
- sync_test.go: TriggerSync on watching transition, adjustInterval
- torrent_test.go: TorrentDownloader lifecycle without network
- stream_server_test.go: HTTP server lifecycle, SetFile/ClearFile,
  concurrent requests, Shutdown releases port, content-type
- manager_integration_test.go: full pipeline — success, torrent→debrid
  fallback, all-fail, multi-concurrent, ForceStart, OnTaskDone,
  recent-finished drain, cancel mid-download, organize
- usenet_test.go: Cancel/Pause race regression test (run with -race)
- daemon_test.go: isAllowedStreamPath table tests
- CI: split coverage gate to engine+agent only (50% threshold); cmd
  coverage still reported but not gated (interactive UI commands)
- lefthook: add pre-push hook with go test -race -count=1 -timeout=120s

internal/cmd/daemon_test.go

@@ -1,6 +1,70 @@
 package cmd
 
-import "testing"
+import (
+	"testing"
+)
+
+func TestIsAllowedStreamPath(t *testing.T) {
+	tests := []struct {
+		name        string
+		filePath    string
+		allowedDirs []string
+		want        bool
+	}{
+		{
+			name:        "path inside download dir",
+			filePath:    "/downloads/movie.mkv",
+			allowedDirs: []string{"/downloads"},
+			want:        true,
+		},
+		{
+			name:        "path inside subdirectory",
+			filePath:    "/downloads/sub/movie.mkv",
+			allowedDirs: []string{"/downloads"},
+			want:        true,
+		},
+		{
+			name:        "path traversal attempt",
+			filePath:    "/downloads/../etc/passwd",
+			allowedDirs: []string{"/downloads"},
+			want:        false,
+		},
+		{
+			name:        "path outside all allowed dirs",
+			filePath:    "/etc/passwd",
+			allowedDirs: []string{"/downloads", "/movies"},
+			want:        false,
+		},
+		{
+			name:        "path inside second allowed dir",
+			filePath:    "/movies/action/movie.mkv",
+			allowedDirs: []string{"/downloads", "/movies"},
+			want:        true,
+		},
+		{
+			name:        "empty allowed dirs",
+			filePath:    "/downloads/movie.mkv",
+			allowedDirs: []string{"", ""},
+			want:        false,
+		},
+		{
+			name:        "path equals allowed dir exactly",
+			filePath:    "/downloads",
+			allowedDirs: []string{"/downloads"},
+			want:        true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := isAllowedStreamPath(tt.filePath, tt.allowedDirs...)
+			if got != tt.want {
+				t.Errorf("isAllowedStreamPath(%q, %v) = %v, want %v",
+					tt.filePath, tt.allowedDirs, got, tt.want)
+			}
+		})
+	}
+}
 
 func TestFormatSpeedLog(t *testing.T) {
 	tests := []struct {