feat(peer): remove downloaded game files safely

Downloaded but uninstalled games can still occupy significant disk space. Add a
separate removal path for that state instead of overloading uninstall, which is
reserved for deleting only `local/` installs.

The peer runtime now exposes `RemoveDownloadedGame` with matching lifecycle
and active-operation events. The filesystem delete is intentionally strict: the
id must be a catalog game and a single path component, the target must be a
direct child of the configured game directory, the root must not be a symlink,
it must have a regular root-level `version.ini`, and it must not contain
`local/`, `.local.installing/`, or `.local.backup/`. Only then do we recursively
remove the game root.

The Tauri bridge exposes this as `remove_downloaded_game`, the frontend shows a
matching danger action only for downloaded-but-uninstalled games, and a
confirmation dialog warns that re-downloading can take a long time.

Test Plan:
- git diff --check
- just fmt
- RUSTC_WRAPPER= CARGO_BUILD_RUSTC_WRAPPER= just test
- RUSTC_WRAPPER= CARGO_BUILD_RUSTC_WRAPPER= just clippy
- RUSTC_WRAPPER= CARGO_BUILD_RUSTC_WRAPPER= just build

Refs: user redesign nitpick about removing downloaded uninstalled games

crates/lanspread-peer/ARCHITECTURE.md

@@ -128,6 +128,11 @@ Reserved per-game paths:
 - `.lanspread_owned` inside `.local.*` directories proves Lanspread ownership
   when the current intent is `None`.
 
+Downloaded-file removal is not an uninstall transaction. It removes the whole
+game root only for a catalog ID that is a single direct child of the configured
+game directory, has a regular root-level `version.ini`, and has no `local/`,
+`.local.installing/`, or `.local.backup/` path.
+
 Recovery reads `.lanspread.json` and combines the recorded intent with the
 observed `local/`, `.local.installing/`, and `.local.backup/` state. Intent
 states `Installing`, `Updating`, and `Uninstalling` prove ownership of the