Harden web/download pipeline and split handler modules

Replace shell-based downloader execution with validated arguments, enforce request hardening and safer defaults, and refactor handlers/router/state so job control is safer and easier to maintain.

README.md

@@ -12,6 +12,7 @@ BaseDir = "/path/to/save/downloads"
 Format = "mkv"
 TempBaseDir = "/tmp/nre"
 EnableConsole = true
+MaxUploadMB = 32
 
 [WatchFolder]
 Path = "/path/to/watched/folder"
@@ -21,6 +22,17 @@ UseInotify = false
 
 [N_m3u8DLRE]
 Path = "/path/to/N_m3u8DL-RE"
+
+[Server]
+Host = "127.0.0.1"
+Port = 8080
+ReadTimeoutSec = 30
+WriteTimeoutSec = 30
+IdleTimeoutSec = 60
+ReadHeaderTimeoutS = 10
+
+[Security]
+AuthToken = ""
 ```
 
 ### Configuration Options
@@ -30,6 +42,7 @@ Path = "/path/to/N_m3u8DL-RE"
   - `Format`: Output format for the downloaded files (e.g., `mkv`, `mp4`).
   - `TempBaseDir`: Temporary directory for intermediate files.
   - `EnableConsole`: Boolean to enable or disable console output.
+  - `MaxUploadMB`: Maximum allowed upload size for the web UI.
 
 - **WatchFolder**
   - `Path`: Directory to watch for new `.drmd` files.
@@ -40,6 +53,14 @@ Path = "/path/to/N_m3u8DL-RE"
 - **N_m3u8DLRE**
   - `Path`: Path to the N_m3u8DL-RE executable.
 
+- **Server**
+  - `Host`: Bind address for the web server (`127.0.0.1` recommended).
+  - `Port`: Web server port.
+  - `ReadTimeoutSec`, `WriteTimeoutSec`, `IdleTimeoutSec`, `ReadHeaderTimeoutS`: HTTP timeout settings.
+
+- **Security**
+  - `AuthToken`: Optional token for protecting all endpoints. Recommended when binding to a non-loopback host.
+
 ### Environment Variable Overrides
 
 You can override the configuration options using environment variables. The following environment variables are supported:
@@ -48,10 +69,14 @@ You can override the configuration options using environment variables. The foll
 - `FORMAT`: Overrides `General.Format`
 - `TEMP_BASE_DIR`: Overrides `General.TempBaseDir`
 - `ENABLE_CONSOLE`: Overrides `General.EnableConsole` (set to `true` or `false`)
+- `MAX_UPLOAD_MB`: Overrides `General.MaxUploadMB`
 - `WATCHED_FOLDER`: Overrides `WatchFolder.Path`
 - `USE_POLLING`: Overrides `WatchFolder.UsePolling` (set to `true` or `false`)
 - `USE_INOTIFY`: Overrides `WatchFolder.UseInotify` (set to `true` or `false`)
 - `POLLING_INTERVAL`: Overrides `WatchFolder.PollingInterval`
+- `SERVER_HOST`: Overrides `Server.Host`
+- `SERVER_PORT`: Overrides `Server.Port`
+- `AUTH_TOKEN`: Overrides `Security.AuthToken`
 
 ## Web UI Usage
 
@@ -62,6 +87,9 @@ You can override the configuration options using environment variables. The foll
 
 2. Open a web browser and go to `http://localhost:8080`
 
+   If `Security.AuthToken` is configured, include it as a query parameter:
+   `http://localhost:8080/?token=YOUR_TOKEN`
+
 3. Use the interface to upload .drmd files and monitor download progress
 
 ## CLI Usage