Add verified official firmware downloads

[alibros]

Summary

• add on-demand downloads for eight official Touch 2 firmware binaries with confirmed MIT redistribution terms
• verify the catalog entry, release origin, HTTPS transport, 16 MB streaming limit, SHA-256, and target profile before caching
• resolve verified cached firmware automatically so it can be installed immediately
• link community entries to the curated Simple Touch 2 directory and their upstream source
• add redistribution notices and bump the app to 0.2.0

Security and licensing

The backend accepts a catalog firmware ID rather than an arbitrary URL. Downloads are limited to this repository's GitHub release assets, and only official entries explicitly marked MIT can be fetched. TouchBass 1.0.2 remains source-only because its upstream repository does not currently expose a redistribution license.

Validation

• cargo test --locked — 8 tests passed before the final metadata-only version bump
• cargo fmt --all -- --check
• cargo metadata --locked --no-deps
• npm run check
• npm run build
• npm audit --omit=dev — 0 vulnerabilities
• git diff --check
• confirmed all eight catalog URLs have matching GitHub release assets

Release note

After merge, tag v0.2.0 to trigger the release workflow and publish a DMG containing this feature.