feat(electron): harden renderer security

Scope playback request header overrides to active stream origins and document the Electron runtime security contract.

apps/electron-backend/src/app/api/main.preload.spec.ts

@@ -84,6 +84,23 @@ describe('main preload DB IPC contract', () => {
         }
     );
 
+    it('forwards scoped user-agent override arguments', async () => {
+        const api = getExposedApi();
+
+        await api.setUserAgent(
+            'ChannelAgent/1.0',
+            'https://portal.example/referrer',
+            'https://stream.example/live.m3u8'
+        );
+
+        expect(mockIpcRenderer.invoke).toHaveBeenLastCalledWith(
+            'set-user-agent',
+            'ChannelAgent/1.0',
+            'https://portal.example/referrer',
+            'https://stream.example/live.m3u8'
+        );
+    });
+
     it('forwards request-scoped DB operation events and unregisters the listener', () => {
         const api = getExposedApi();
         const callback = jest.fn();

apps/electron-backend/src/app/api/main.preload.ts

@@ -299,8 +299,11 @@ const electronApi = {
     ) => ipcRenderer.invoke('save-file-dialog', defaultPath, filters),
     writeFile: (filePath: string, content: string) =>
         ipcRenderer.invoke('write-file', filePath, content),
-    setUserAgent: (userAgent: string, referer?: string) =>
-        ipcRenderer.invoke('set-user-agent', userAgent, referer),
+    setUserAgent: (
+        userAgent?: string | null,
+        referer?: string | null,
+        scopeUrl?: string | null
+    ) => ipcRenderer.invoke('set-user-agent', userAgent, referer, scopeUrl),
     openInMpv: (
         url: string,
         title: string,