Harden server and fix client-side edge cases
Python: per-file error handling in cleanup, single stat() in download,
S_ISREG check, Content-Disposition escaping, Content-Length on all
responses, route prefix passed to handlers (no magic numbers), validate
empty upload, ensure_cert handles partial cert pair, narrower exception
catches.
JS: visibility-aware polling, concurrent upload guard, fetch r.ok checks,
missing .catch() on delete/loadFiles, REFRESH_SEC→REFRESH_MS rename,
explicit parseInt radix, transition: all→specific properties.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>