v1.2.1 — Security hardening

• Companion app's localhost HTTP API now requires a per-session Bearer
  token (generated on startup, stored in the user's tmpdir with 0600
  permissions). Eliminates CSRF from malicious websites targeting the
  localhost service.
• /openFolder is now restricted to files inside the configured download
  directory. Paths outside are rejected.
• Stricter CORS: only browser extension origins are allowed.
• Protected endpoints require Content-Type: application/json.
• Request bodies are capped at 64 KiB.
• No extension-facing behaviour changes; users should not notice anything.

v1.2.0 — New features and fixes

New:
- Authenticated HLS support — cookies and headers from the browser are automatically forwarded to the companion app for private/paywalled streams
- Open Folder button on completed downloads — reveals the file in your native file manager
- Cancel button for active and queued downloads — stops ffmpeg and updates history
- Human-readable filenames — uses the detected video title instead of the URL slug
- Auto-start guide for the companion app (Startup folder, Scheduled Task, manual) — see AUTOSTART.md in the repo

Fixes:
- Excluded .ts HLS segments from the detected-videos list to declutter the UI; only .m3u8 playlists are shown for HLS downloads

Companion app:
- New /openFolder and /cancel HTTP endpoints (localhost only)
- Native messaging bridge updated to forward the new actions
- Companion version bumped to 1.2.0 to match the extension