Pin three untested guards: download timer, URL fragment, short APP1 (closes #89)

The download idle deadline's timer is unref'd so it never holds the
process open, and a test checks no timer is left after a download
completes or fails. A test covers the rejection of "#" in a request
path. The EXIF scan accepts an APP1 segment only when its length is at
least 8, since a shorter one cannot hold the six-byte Exif header;
tests cover lengths 7 and 8.

Model: opus-5-5

src/api/client.ts

@@ -49,8 +49,8 @@ export interface StreamOptions {
 // An abort signal that fires once `ms` pass without a call to `restart`. It
 // aborts with a `TimeoutError`, the same reason `AbortSignal.timeout()` gives,
 // so the retry classifier treats an idle download exactly as it treats any
-// other deadline. `stop` must be called when the download ends, or the timer
-// keeps the process alive until it fires.
+// other deadline. `stop` must be called when the download ends. The timer is
+// unref'd, so even one left running never keeps the process alive.
 const idleDeadline = (ms: number) => {
     const controller = new AbortController();
     let timer: ReturnType<typeof setTimeout> | undefined;
@@ -65,6 +65,7 @@ const idleDeadline = (ms: number) => {
                 ),
             );
         }, ms);
+        timer.unref();
     };
     restart();
     return { signal: controller.signal, restart, stop };