[Linuxuser67]

Summary

• Route yt-dlp and gallery-dl network requests for unconfirmed browser handoffs through a loopback proxy that rejects private and special-use destinations and connects to the checked IP address.
• Guard the subtitle probe, live capture, HLS download, gallery file-count probe, and other extractor subprocess paths.
• Keep untrusted handoff provenance separate from redirect-only DNS filtering; fail closed when the handoff-host policy reaches capacity and FIFO-evict old entries from the redirect-only cache.
• Apply one shared 64-distinct-host limit to automatic playlist expansion and the interactive picker for untrusted collections. Explain host-limit skips in the resulting row details or picker caption, and preserve the picker limit across partial imports.
• Preserve the actual transport scheme while sanitizing sparse extractor data, and verify the media URL itself is HTTPS before selecting it.
• Persist the public-only policy for newly marked download and gallery rows so their network restrictions survive queue restarts.
• Redact URL query strings and fragments from backend command and stderr diagnostics.
• Use Tokio 1.53.3 from the maintained 1.53 LTS line, constrain updates to that minor line, and regenerate the Flatpak source manifest.

Regression coverage

• Protocol inference and HTTPS media URL validation.
• Host-policy capacity, collection-child inheritance, per-collection host limits, and FIFO redirect-cache eviction.
• Backward-compatible queue metadata serialization.
• Proxy authority parsing and rejection of private CONNECT destinations.
• Guarded extractor argument placement, missing-terminator fail-closed behavior, proxy bypass environment settings, and signed URL redaction.

Verification

The changes are pushed to this draft PR and the CI suite is running against the latest head (formatting, Clippy, Rust tests, UI tests, structure, vendor sync, and security/dependency audits). No merge is requested in this PR.