chore(deps): update all dependencies and GitHub Actions to latest

- Go deps: cobra 1.10.2, fatih/color 1.19, tablewriter 1.1.4,
  anacrolix/torrent 1.61, charmbracelet/huh 1.0, pion/webrtc 4.2.11
- GitHub Actions: checkout v6, setup-go v6, golangci-lint-action v9,
  codecov-action v5, ghaction-upx v4, goreleaser-action v7
- CI matrix: drop Go 1.22, test on 1.24 + 1.25
- Migrate tablewriter API from v0 to v1 (breaking change)
- Fix data race in WSTransport.readLoop (pass conn as parameter)
- Add file.Sync() before close in debrid and usenet downloaders
- Improve progress tracker: dedup MarkDone, re-mark dirty on flush error

internal/engine/usenet.go

@@ -136,9 +136,12 @@ func (u *UsenetDownloader) Download(ctx context.Context, task *Task, outputDir s
 		if err != nil {
 			return nil, fmt.Errorf("download NZB: %w", err)
 		}
-		// Cache for future resume
-		os.MkdirAll(resumeDir, 0o755)
-		os.WriteFile(nzbCachePath, nzbData, 0o644)
+		// Cache for future resume (best-effort — download still works without cache)
+		if mkErr := os.MkdirAll(resumeDir, 0o755); mkErr != nil {
+			log.Printf("[%s] resume dir create failed: %v", shortID, mkErr)
+		} else if wErr := os.WriteFile(nzbCachePath, nzbData, 0o644); wErr != nil {
+			log.Printf("[%s] NZB cache write failed: %v", shortID, wErr)
+		}
 	} else {
 		log.Printf("[%s] using cached NZB", shortID)
 	}
@@ -162,6 +165,11 @@ func (u *UsenetDownloader) Download(ctx context.Context, task *Task, outputDir s
 			shortID, tracker.TotalCompleted(), totalSegs)
 	}
 
+	// Always flush progress on exit — covers graceful shutdown, SIGTERM,
+	// error returns, and shutdown-timeout scenarios. The atomic write
+	// (tmp+rename) ensures the file is never corrupted even on hard kill.
+	defer tracker.Flush()
+
 	// Step 4: Get NNTP credentials and connect
 	creds, err := u.getCredentials(dlCtx)
 	if err != nil {