refactor(lib_commands): centralise HTTP-stream-to-disk pattern in file_transfer

Pull the duplicated `subsonic UA + timeout client builder` and
`stream → .part → rename → cleanup` flow out of cache/offline.rs,
sync/device.rs, and sync/batch.rs into a new lib_commands/file_transfer
module.

- subsonic_http_client(timeout): standard UA + single timeout. Used by
  the 3 simple-timeout sites (offline track, sync_track, batch sync).
  download_update / download_zip / fetch_netease_lyrics keep their own
  builders since they need separate connect+overall timeouts or extra
  headers.
- stream_to_file(response, dest): chunked HTTP body → file (moved from
  cache/offline.rs, where it was the de-facto shared helper anyway).
- finalize_streamed_download(response, dest, part): stream to .part
  then rename, with best-effort cleanup of .part on any failure.

Behaviour delta: the offline + device single-track flows now also clean
up an orphan .part file when the final rename fails — previously only
the batch sync did this. Strictly safer; no observable change on the
success path.

downloads.rs (download_update / download_zip) keeps its inline progress
chunk loops — those emit per-chunk progress events with flow-specific
payload shapes and intervals; sharing them would force a callback API
that's heavier than the duplication it removes.

Net delta: -53 LOC across the 3 call sites.

src-tauri/src/lib_commands/sync/device.rs

@@ -345,11 +345,7 @@ pub(crate) async fn sync_track_to_device(
             .map_err(|e| e.to_string())?;
     }
 
-    let client = reqwest::Client::builder()
-        .user_agent(subsonic_wire_user_agent())
-        .timeout(std::time::Duration::from_secs(300))
-        .build()
-        .map_err(|e| e.to_string())?;
+    let client = subsonic_http_client(std::time::Duration::from_secs(300))?;
 
     let response = client.get(&track.url).send().await.map_err(|e| e.to_string())?;
     if !response.status().is_success() {
@@ -361,16 +357,12 @@ pub(crate) async fn sync_track_to_device(
     }
 
     let part_path = dest_path.with_extension(format!("{}.part", track.suffix));
-    if let Err(e) = stream_to_file(response, &part_path).await {
-        let _ = tokio::fs::remove_file(&part_path).await;
+    if let Err(e) = finalize_streamed_download(response, &dest_path, &part_path).await {
         let _ = app.emit("device:sync:progress", serde_json::json!({
             "jobId": job_id, "trackId": track.id, "status": "error", "error": e,
         }));
         return Err(e);
     }
-    tokio::fs::rename(&part_path, &dest_path)
-        .await
-        .map_err(|e| e.to_string())?;
 
     let _ = app.emit("device:sync:progress", serde_json::json!({
         "jobId": job_id, "trackId": track.id, "status": "done", "path": path_str,