Add one-use download tickets, bounded HTTP file responses, source validation, shared transfer capacity, cancellation, and metadata-only audit. Verification: 181 focused tests, macOS/iOS builds, Swift formatting, and Chinese localization checks passed. Full test run: 1430 tests with five failures in unchanged areas; no live-server integration performed.