feat: harden credential handling

[bilalbayram]

Summary

• Stop serializing/deserializing the raw Apple ID password in stored account credentials.
• Sanitize account JSON output so auth info --format json and login JSON output no longer expose stored secrets.
• Narrow verbose logging to ipatool crates and remove App Store response body previews from debug logs.
• Save the ipatool data directory and cookie file with private Unix permissions.
• Update README guidance to prefer interactive login over command-line password flags.
• Validate IPA download HTTP status/content type before writing data, fail stalled downloads, fix ignored range-resume corruption, and add ranged parallel CLI downloads via --connections.

Why

The CLI handles Apple ID credentials and App Store session data. The previous behavior could persist the raw Apple ID password, expose it in JSON output, and enable dependency debug logs that include cookie details.

The download path also accepted any HTTP response as IPA bytes, so CDN errors or HTML responses could be written to .ipa.tmp and only fail later during patching. Single-connection downloads can also be very slow on some Apple CDN paths, so the CLI now supports modest parallel ranged downloads.

Validation

• cargo fmt --all --check
• cargo test --workspace --locked
• cargo check --workspace --locked
• cargo clippy --all-targets --all-features --locked -- -D warnings
• cargo build --release --locked
• git diff --check

[Kosthi]

Thanks for the PR! I will review it soon.

[Kosthi]

Code Review

Finding 1 — Orphaned tasks in download_file_parallel (correctness)

crates/ipatool-core/src/api/download.rs

Each range worker is launched with tokio::spawn. When any worker fails the function runs cleanup_parts (which deletes the .ipa.partN files) and returns Err. Dropping the FuturesUnordered at that point detaches — not cancels — the remaining spawned tasks. Those tasks keep issuing HTTP range requests and writing to the now-deleted part files; the resulting OS errors are silently lost via the detached JoinHandle.

On a slow CDN with the default of 4 connections and a large IPA, three background tasks can hold TCP sessions open and consume bandwidth until they time out independently.

Fix: collect each JoinHandle in a Vec and call .abort() on every unfinished handle before returning in both error arms:

Ok(Err(err)) => {
    for handle in &handles { handle.abort(); }
    cleanup_parts(&part_paths).await;
    // ...
    return Err(err);
}

---

Finding 2 — looks_like_error_body heuristic duplicated (cleanup)

crates/ipatool-core/src/api/download.rs + crates/ipatool-cli/src/tui/mod.rs

The PR introduces a private looks_like_error_body function in download.rs and inlines the same three-way text/ / html / json check as a local block inside stream_download in tui/mod.rs. These two copies can drift silently — for example if application/xml Apple error envelopes are later added to the heuristic, only one site would be updated.

Fix: promote looks_like_error_body to pub(crate) (or move it to a small shared http_util module) and call it from stream_download instead of re-implementing inline.