Add download cancel/delete and harden the patch pipeline

Cancel a running download (the worker aborts mid-piece and the partial
file is removed) or delete a finished package, from the queue or the
title card. The progress callback now returns an abort signal that
reaches libcurl and the manifest merge loop.

Manifest merge: bound the piece scan to the "pieces" array so a later
"url" key (e.g. playgoChunkCrcUrl) can't be appended as a bogus piece,
and require each piece's fileOffset to match the bytes written so far so
an out-of-order manifest fails instead of silently producing a corrupt
package.

Report real free space on the download partition via statvfs; it was a
hardcoded 0.

Fixes found in review:
- scan: bound the SFO entry table to the bytes actually read and require
  the key to be NUL-terminated before strcmp (OOB read on a crafted
  param.sfo from a shadow-mounted dir).
- proc: bound the kinfo_proc walk and the name compare to the record and
  the buffer.
- install: publish the API probe under the lock (data race with the MHD
  worker thread) and initialize rc2.
- verxml: reject a truncated attribute value instead of returning it as
  valid.
- web: keep download/install/downloaded flags across a refresh, stop the
  queue poll only after repeated empty results, coerce the progress
  number, and treat a cancelled download (HTTP 200, ok:false) as
  not-downloaded.

README.md

@@ -19,8 +19,8 @@ by Knutwurst
   query to 1.1.1.1) and verifies TLS against the pinned SCEI DNAS root.
 - Picks the newest patch compatible with the current firmware
   (`system_ver <= firmware`), so an update never forces a firmware upgrade.
-- Downloads the patch package and installs it through Sony's AppInstUtil
-  service.
+- Downloads the installable package from Sony's manifest pieces and installs it
+  through Sony's AppInstUtil service.
 
 ## Safety model
 
@@ -41,6 +41,14 @@ the target; that storage id is accepted only when `version.xml` targets the
 installed title. A true target-title mismatch is refused instead of installed as
 a phantom title.
 
+For PS5 titles, `delta_url` often points to a small `*-DP.pkg` helper package.
+That bootstrap can make the system fetch the full patch, but it follows the
+package's storage/master title id and can create a duplicate/ghost title for
+cross-region updates. PatchDL therefore prefers the Sony `manifest_url`,
+downloads every listed `pieces[]` entry in order, and concatenates them into one
+local `.pkg` before handing it to AppInstUtil. The `delta_url` title id is kept
+only as the storage/master-id diagnostic.
+
 ## Build
 
 Requires `ps5-payload-dev/sdk`. The network and install features also need the
@@ -72,12 +80,16 @@ http://<console-ip>:12880/
 ## Status
 
 0.0.2, early. Title scan, source classification, version resolution,
-firmware-compatibility filtering, download, and install work and have been
-verified on firmware 11.60. Patches download internally to `/data/patchdl` and
-are removed once the install has applied. Each title has a single action button
-(Download then Install, or Update when "install after download" is on). Open
-items: the web UI marks a title "Installing…" but reads progress from the PS5's
-own notifications rather than a percentage; a download queue is not built yet;
-disc-based games need the disc inserted for their patch to apply (a normal Sony
-requirement). Settings (global policy and the per-game toggle) persist to
+firmware-compatibility filtering, target/storage-id handling, and the local
+AppInstUtil HTTP stream have been verified on firmware 11.60. PatchDL now
+downloads PS5 update manifests as merged piece packages under `/data/patchdl`;
+large retail updates can be tens of GB. The download queue shows live progress,
+and each download can be cancelled (the partial file is deleted) or a finished
+package deleted again, from the queue or the title card. Manifest pieces are
+verified in offset order and against their declared size while merging. Open
+items: a full large-title manifest download/install still needs an end-to-end
+run, the web UI marks a title "Installing…" but reads progress from the PS5's
+own notifications rather than a percentage, and disc-based games need the disc
+inserted for their patch to apply (a normal Sony requirement).
+Settings (global policy and the per-game toggle) persist to
 `/data/patchdl/config.json` and survive a restart.