Persist canonical offline download metadata on completion

[StaticHumStudio]

A completed download does not persist per-track localPath, canonical audioFiles in index order, or chapters onto the AudioBook row, so offline playback reconstructs filenames from the server response every time. PR #33 fixed this inside an engine rewrite that could not be salvaged because every line went through the dropped owner-scope fences.

What the salvage PRs do cover: a sparse sync response no longer wipes a downloaded book's track metadata, colliding sanitized filenames are disambiguated, and audio files are sorted by index before download.

What this issue covers, as one standalone task on master:

1. On completion, upsert the AudioBook row with isDownloaded, localPath, the canonical audioFiles list carrying each track's on-disk localPath, and chapters, inside the same commit boundary as the cover write.
2. The cover write must be best-effort. A cover IOException must never discard the completion metadata. PR Complete prerelease reliability and account-isolation repairs #33 got this wrong and it was one of the reasons it was closed.
3. Path-containment guard: every resolved track path must resolve inside the download directory.
4. A legacy backfill for downloads that predate this change.
5. deleteDownload must still clear the book row and delete files when the DownloadItem row is already gone (Clear All removes rows by design). Do not copy PR Complete prerelease reliability and account-isolation repairs #33's early return, it made this strictly worse.