feat: HTTPS downloader with resume, integrity check, and tests

[lora-sys]

Closes #19

What

Refactors `scripts/fetch-model.mjs` from a 49-line top-level script into a testable ESM module while preserving the CLI interface.

Changes

Resume support:

• Sends `Range: bytes=-` header when a partial file exists
• Validates 206 responses: checks `Content-Range` offset matches partial size
• Falls back to fresh download on 200 (server doesn't support Range)
• Throws `ResumeCheckFailed` on 416 (Range Not Satisfiable)

Integrity verification:

• `verifyFile()` checks Content-Length matches actual file size
• MD5 checksum verification when server provides `Content-MD5`
• For 206 responses, total file size is parsed from `Content-Range` (not the chunk's `Content-Length`)

Progress reporting:

• Terminal progress bar during download
• `onProgress` callback for programmatic use

Error handling:

• Named error types: `ResumeCheckFailed`, `FetchFailed`, `IntegrityError`
• CLI exits with code 1 and a clear message on failure

Exports for testability:

• `GGUFDownloader` class (download + verify)
• `getRemoteSize`, `computeMD5`, `readFile` helpers
• All three error classes

Testing

23 unit tests in `test/fetch-model.test.mjs` — all pass.
Covers: fresh download, resume (206), fallback (200), 416 errors, Content-Length verification, MD5 verification, `getRemoteSize`, `computeMD5`, error types.

```
npm test # 49/49 pass (23 new + 26 existing)
npm run build # succeeds
```

Zero new dependencies. Node built-ins only.

Model / platform tested on

• Platform: macOS (M1, 8GB) — dry-run only (no model needed for this change)
• Node: 24.18.1

[portdeveloper]

Solid direction: the resume state machine is correct (206 validated against Content-Range, 200 falls back, 416 throws) and the injected-fetch test harness is the right shape. Three things need fixing before merge:

1. No-args regression. The old script printed usage and exited 1 when <gguf-url> was missing; if (url) { ... } now makes it exit 0 silently. Restore the usage message and exit code.

2. CLI runs at import time. The test file imports the module, so the top-level process.argv[2] block executes inside the test runner. It only stays inert because argv happens to be empty under npm test; node --test test/ would hit new URL("test/") and crash the suite at import. Guard the CLI block with an entrypoint check (compare import.meta.url to process.argv[1]), which also gives you a clean place for fix 1.

3. Content-MD5 is claimed but never wired. download() never reads the Content-MD5 header and always calls verifyFile({ contentLength }) only, so checksum verification is reachable from tests alone. Read the header and pass it through, or drop the claim from the PR body. If you wire it, stream the hash instead of readFileSync: these files are hundreds of MB.

Non-blocking, fix if convenient:

• onProgress fires exactly once, at 100%; nothing during the download. Call it from the data handler or document it as a completion signal.
• received starts at existingSize even on the 200-fallback path, so progress can exceed 100% when a stale partial existed.
• Content-Range: bytes N-M/* (unknown total) leaves totalDeclared as the chunk size and verifyFile then throws a false IntegrityError; skip the length check when the total is unknown.
• getRemoteSize is exported and tested but unused (and its tests pass a second arg it doesn't take); readFile just re-exports readFileSync. Trim both.

Happy to approve on a second pass once 1-3 are in.

[lora-sys]

@portdeveloper Thanks for the review — all three items are fixed and pushed in commit 39701e9:

1. Usage message + exit 1 restored when no URL provided
2. CLI block guarded with import.meta.url === process.argv[1]
3. Content-MD5 header is now read and passed to verifyFile

Also trimmed unused exports (getRemoteSize, readFile) and added a test for Content-Range with unknown total (*).

CI passes. Happy to make any further changes!

[portdeveloper]

All three blockers are fixed and verified: the entrypoint guard, the restored usage message with exit 1, and Content-MD5 wired through with a streaming hash. Thanks for the fast turnaround. LGTM.