chore+fix: repo hygiene, code-review fixes, audit cleanup

Three independent code reviews + a security audit produced ~200 findings.
This commit lands the high-impact subset. Tests pass (53), typecheck
clean, eslint clean (3 minor exhaustive-deps warnings left).

REPO HYGIENE
- Add .editorconfig, .prettierrc.json, .prettierignore.
- Add ESLint flat config (.eslintrc.cjs) — correctness-focused, no style
  rules (Prettier owns formatting).
- Add `format` / `format:check` / `lint` npm scripts.
- Add CHANGELOG.md (Keep a Changelog format, back-filled to 0.1.x).
- Reformat all source via Prettier so future diffs stay small.

DATA SAFETY (src/main/store.ts)
- Atomic write (tmp + rename) with retry on transient EBUSY/EPERM —
  was non-atomic writeFileSync, vulnerable to truncation on power loss.
- On corrupt JSON, rename to `app-state.json.corrupt-<ts>` instead of
  silently overwriting the user's exercises/history with defaults.
- Validate parsed shape before merging — reject arrays/scalars where
  objects expected; per-field array checks.
- Strip `id` from incoming patches in updateExercise/updateChallenge —
  a runtime caller (IPC) could otherwise smuggle id changes through.
- clearHistory now refuses an unbounded wipe (no beforeTs => no-op);
  callers must pass an explicit boundary.
- unref() the debounce timer so it doesn't keep the event loop alive.

SECURITY (src/main/*)
- gsi-server: hard 256 KB body cap (was unbounded — local OOM vector),
  reject any Origin/Sec-Fetch-Site header (blocks browser CSRF from
  visited pages), require application/json Content-Type, generic 400
  on parse error (no error string echo to client), closeAllConnections
  + async close on stop.
- dota2: validate auth.token from payload with timingSafeEqual against
  the per-install token — was unauthenticated, any local process could
  forge match-end events. Narrow object shape before spread-merge to
  avoid throws on hostile payloads like {player:"x"}. Reset latest /
  prevState after match_end so the next match starts clean.
- ipc: gate `dev:simulateMatchEnd` registration behind `!app.isPackaged`
  so it does not exist in shipped builds.
- preload: gate the matching `simulateMatchEnd` export behind
  `import.meta.env.MODE !== 'production'` so the bundler dead-code-
  eliminates it from the production preload bundle.
- windows: shell.openExternal allowlist (http/https/mailto only) — was
  forwarding any URL, including file:/javascript:/custom URI handlers
  (some Windows handlers have been RCE vectors). will-navigate blocks
  navigation to anywhere except file:// or the dev URL.

CORRECTNESS (src/main/* + src/shared/*)
- shared/types.ts isQuietAt: fix wrap-around + day-of-week filter.
  With from=22:00 to=07:00 days=[Mon..Fri], the window started THE
  PREVIOUS DAY when we're in the AM half — old code checked today's
  day-of-week and got the wrong answer Sat 02:00 and Mon 01:00. Now
  the filter is evaluated against the window's START day. Also reject
  malformed HH:MM strings instead of producing NaN.
- scheduler: call broadcastState() after firing exercises so the
  renderer's Dashboard/Exercises pages don't show stale nextFireAt
  until the next state-changing IPC. Guard powerMonitor listeners
  against double-registration on dev hot-reload.
- dota2: fix `launchOptionStatus = steamRunning ? 'queued' : 'queued'`
  tautology — both branches now correctly read 'queued'.
- steam-launch-options: replace `require('node:fs')` inside atomicWrite
  with the top-level import; retry on transient EBUSY/EPERM.

CORRECTNESS (src/renderer/*)
- lib/history.ts: replace `today.getTime() - i * MS_DAY` arithmetic
  with `setDate(date - i)` calendar arithmetic in dailyRepsRange and
  currentStreak — DST transitions shift epoch math by ±1h and cause
  dayKey() to emit duplicate or missing days at the boundary.
- lib/icon.tsx: restrict name lookup to ICON_CHOICES set — an arbitrary
  string from a corrupted state file could otherwise resolve to
  unrelated Lucide exports and crash the renderer.
- lib/format.ts: guard formatCountdown against NaN/Infinity.
- i18n/index.ts: replace regex-based interpolation with split/join so
  variable values containing regex metacharacters interpolate
  literally; warn in dev on missing keys; clamp pluralRu(-N) via abs.
- ReminderApp: keyboard shortcuts moved INTO ExerciseReminder so Enter
  respects the stepper's `adjusted` flag (was always passing planned
  reps). Stepper capped at 5× planned. Don't hijack Space when a
  button is focused. `key={exercise.id+nextFireAt}` forces a fresh
  component for back-to-back reminders so stepper state resets. Match
  summary view gets Esc-to-close. Functional setMode in onMarkDone
  avoids races against stale `mode.done`.
- UpdaterCard: guard against NaN/Infinity in download-progress events
  (electron-updater fires early events with undefined fields).
- Games: gate DevPanel behind `import.meta.env.DEV` in addition to the
  main-side IPC gate, and narrow the `simulateMatchEnd` access.
- Add aria-labels for the +/- stepper buttons (i18n keys added).

TESTS
- +2 quiet-hours tests covering wrap-around + day-filter combo and
  malformed HH:MM fallback. Total 53 passing.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/shared/types.ts

@@ -130,10 +130,10 @@ export type GameStatus = {
   name: string
   installed: boolean
   installPath?: string
-  integrationActive: boolean   // cfg installed + listener running
-  launchOption?: string        // e.g. "-gamestateintegration"
+  integrationActive: boolean // cfg installed + listener running
+  launchOption?: string // e.g. "-gamestateintegration"
   launchOptionStatus: LaunchOptionStatus
-  steamRunning?: boolean       // helps the UI explain queued state
+  steamRunning?: boolean // helps the UI explain queued state
   enabled: boolean
 }
 
@@ -176,33 +176,81 @@ export const DEFAULT_SETTINGS: Settings = {
   }
 }
 
+const HHMM_RE = /^(\d{1,2}):(\d{2})$/
+
+/** Parse `HH:MM` into minutes-since-midnight, or `null` if malformed. */
+function parseHHMM(s: string): number | null {
+  const m = HHMM_RE.exec(s)
+  if (!m) return null
+  const h = Number(m[1])
+  const min = Number(m[2])
+  if (!Number.isFinite(h) || !Number.isFinite(min)) return null
+  if (h < 0 || h > 23 || min < 0 || min > 59) return null
+  return h * 60 + min
+}
+
 /**
  * Returns true if `now` falls inside the quiet window. Handles wrap-around
- * windows (e.g. 22:00 → 08:00). Exposed from shared so both main scheduler
- * and renderer settings UI can use the same logic.
+ * windows (e.g. 22:00 → 08:00) AND day-of-week filtering correctly: when the
+ * window started the previous day (we're in the AM half of a wrap-around),
+ * the day filter is evaluated against the START day, not the current day.
+ *
+ * Example: from=22:00, to=07:00, days=[Mon..Fri]. At Sat 02:00 the window
+ * is active (started Fri 22:00 — Friday is in the filter). At Mon 01:00 the
+ * window is NOT active (would have started Sun 22:00 — Sunday is excluded).
+ *
+ * Malformed `from`/`to` strings (after a corrupt state file) return false.
  */
 export function isQuietAt(qh: QuietHours, now: Date): boolean {
   if (!qh.enabled) return false
-  const dow = now.getDay() // 0..6
-  if (qh.days.length > 0 && !qh.days.includes(dow)) return false
-  const [fh, fm] = qh.from.split(':').map(Number)
-  const [th, tm] = qh.to.split(':').map(Number)
-  const cur = now.getHours() * 60 + now.getMinutes()
-  const fromMin = fh * 60 + fm
-  const toMin = th * 60 + tm
+  const fromMin = parseHHMM(qh.from)
+  const toMin = parseHHMM(qh.to)
+  if (fromMin === null || toMin === null) return false
   if (fromMin === toMin) return false
+
+  const cur = now.getHours() * 60 + now.getMinutes()
+  const todayDow = now.getDay() // 0..6, 0=Sunday
+  const yesterdayDow = (todayDow + 6) % 7
+
+  // Helper: is this day included by the filter?
+  const dayActive = (dow: number): boolean =>
+    qh.days.length === 0 || qh.days.includes(dow)
+
   if (fromMin < toMin) {
-    // Same-day window.
+    // Same-day window — start day is `todayDow`.
+    if (!dayActive(todayDow)) return false
     return cur >= fromMin && cur < toMin
   }
-  // Wraps midnight: active if after `from` today OR before `to` today.
-  return cur >= fromMin || cur < toMin
+  // Wrap-around window. Either:
+  //   - cur >= fromMin: window started TODAY at fromMin → check todayDow
+  //   - cur < toMin: window started YESTERDAY at fromMin → check yesterdayDow
+  if (cur >= fromMin) return dayActive(todayDow)
+  if (cur < toMin) return dayActive(yesterdayDow)
+  return false
 }
 
 export const SAMPLE_EXERCISES: Omit<Exercise, 'id' | 'nextFireAt'>[] = [
-  { name: 'Приседания', reps: 10, icon: 'Activity', intervalMinutes: 30, enabled: true },
-  { name: 'Отжимания', reps: 10, icon: 'Dumbbell', intervalMinutes: 45, enabled: true },
-  { name: 'Растяжка спины', reps: 1, icon: 'StretchHorizontal', intervalMinutes: 60, enabled: false }
+  {
+    name: 'Приседания',
+    reps: 10,
+    icon: 'Activity',
+    intervalMinutes: 30,
+    enabled: true
+  },
+  {
+    name: 'Отжимания',
+    reps: 10,
+    icon: 'Dumbbell',
+    intervalMinutes: 45,
+    enabled: true
+  },
+  {
+    name: 'Растяжка спины',
+    reps: 1,
+    icon: 'StretchHorizontal',
+    intervalMinutes: 60,
+    enabled: false
+  }
 ]
 
 export type UpdaterStatus =
@@ -220,4 +268,3 @@ export type UpdaterStatus =
     }
   | { kind: 'downloaded'; version: string }
   | { kind: 'error'; message: string }
-