perf: optimize state management, add HTTPS validation, improve UI performance

- Add HTTPS-only validation for APK downloads and update checks
- Use .select() for Riverpod providers to prevent unnecessary rebuilds
- Add keys to all list builders for efficient updates
- Implement request cancellation for outdated API requests
- Debounce all network requests (URLs and searches)
- Limit file existence cache to 500 entries
- Add ref.onDispose for timer cleanup
- Add error handling for share intent stream
- Redesign About page with Material Expressive 3 style
- Rename Search tab to Home
- Remove Features section from README

lib/services/apk_downloader.dart

@@ -14,9 +14,18 @@ class ApkDownloader {
     required String version,
     ProgressCallback? onProgress,
   }) async {
+    // Validate URL for security
+    final uri = Uri.tryParse(url);
+    if (uri == null || uri.scheme != 'https') {
+      _log.e('Refusing to download from invalid or non-HTTPS URL');
+      return null;
+    }
+
+    final client = http.Client();
+    IOSink? sink;
+    
     try {
-      final client = http.Client();
-      final request = http.Request('GET', Uri.parse(url));
+      final request = http.Request('GET', uri);
       final response = await client.send(request);
 
       if (response.statusCode != 200) {
@@ -41,7 +50,7 @@ class ApkDownloader {
         await file.delete();
       }
 
-      final sink = file.openWrite();
+      sink = file.openWrite();
       int received = 0;
 
       await for (final chunk in response.stream) {
@@ -50,14 +59,15 @@ class ApkDownloader {
         onProgress?.call(received, contentLength);
       }
 
-      await sink.close();
-      client.close();
-
+      await sink.flush();
       _log.i('Downloaded to: $filePath');
       return filePath;
     } catch (e) {
       _log.e('Error: $e');
       return null;
+    } finally {
+      await sink?.close();
+      client.close();
     }
   }
 

lib/services/update_checker.dart

@@ -92,6 +92,12 @@ class UpdateChecker {
         final name = (asset['name'] as String? ?? '').toLowerCase();
         if (name.endsWith('.apk')) {
           final downloadUrl = asset['browser_download_url'] as String?;
+          // Only accept HTTPS URLs for security
+          final uri = downloadUrl != null ? Uri.tryParse(downloadUrl) : null;
+          if (uri == null || uri.scheme != 'https') {
+            _log.w('Skipping non-HTTPS APK URL: $downloadUrl');
+            continue;
+          }
           if (name.contains('arm64') || name.contains('v8a')) {
             arm64Url = downloadUrl;
           } else if (name.contains('arm32') || name.contains('v7a') || name.contains('armeabi')) {