fix(downloads): send browser-like headers and reuse one HTTP client

[davidscottpope-gif]

Problem

download_file built a fresh reqwest HTTP client for every file and sent only a Cookie header. To a host or CDN that filters on User-Agent or Referer, the request does not look like it came from the page, so a download can be rejected (or answered with an error page saved as the file) even though the same URL opens fine in the webview. Writes also used blocking std::fs inside the async command.

Solution

Send the headers the webview itself would send:

• The injected JS passes navigator.userAgent and window.location.href with every download_file call (all three call sites: link guard, image download, context menu).
• Rust derives a Referer from the page URL following the browser default strict-origin-when-cross-origin policy: full page URL with the fragment stripped for same-origin downloads, origin only for cross-origin, and no Referer on an https -> http downgrade or from a non-http(s) page.
• Session cookies are forwarded as before; every header is best-effort and skipped when it cannot be a valid header value.
• One shared reqwest client (OnceLock) is reused across downloads instead of paying for a new client per file.
• File writes use tokio::fs so the async runtime is not blocked (adds the tokio "fs" feature).

Tests

• 6 new Rust unit tests cover the Referer rules (same-origin, cross-origin, downgrade, non-http page) and header assembly.
• Updated two event-link-guard expectations for the new params.
• Full CI passed on my fork with the same Quality & Testing workflow (fmt, Clippy, cargo test, CLI validation, Tauri builds on Linux/Windows/macOS, Docker packaging): https://github.com/davidscottpope-gif/Pake/actions/runs/36422432128

[tw93]

@davidscottpope-gif Thanks for the contribution. It is merged and shipped in pake-cli 3.17.3, together with a few changes made before merging: the browser download fallback stays in place when native IPC is not allowed, the shared HTTP client reports an error instead of panicking, files are flushed before the success toast, and credentials are stripped from the Referer. Redirects now keep the window's session cookies on each hop.

Run npm install -g pake-cli@3.17.3 and rebuild an app to get it.