Harden web/download pipeline and split handler modules

Replace shell-based downloader execution with validated arguments, enforce request hardening and safer defaults, and refactor handlers/router/state so job control is safer and easier to maintain.

config.template.toml

@@ -3,6 +3,7 @@ BaseDir = "/mnt/media"
 Format = "mkv"
 TempBaseDir = "/tmp/nre"
 EnableConsole = true
+MaxUploadMB = 32
 
 [WatchFolder]
 Path = "/mnt/watched"
@@ -12,3 +13,14 @@ UseInotify = false
 
 [N_m3u8DLRE]
 Path = "nre"
+
+[Server]
+Host = "127.0.0.1"
+Port = 8080
+ReadTimeoutSec = 30
+WriteTimeoutSec = 30
+IdleTimeoutSec = 60
+ReadHeaderTimeoutS = 10
+
+[Security]
+AuthToken = ""