feat(rust): port state.py, globalstore.py and manifest appending

- src/state.rs: per-run state.json (status/attempts/error/files/updated),
  corrupt-file -> *.json.bak restart, atomic tmp+rename save, mark() parity
  (attempts increments, None fields never clear existing values)
- src/globalstore.rs: cross-run urls.json at XDG_DATA_HOME or
  ~/.local/share/dlphelper/urls.json, disabled-store no-op
- src/manifest.rs: append_manifest as compact JSONL, UTF-8
- unknown/extra JSON fields are preserved on round-trip so both versions can
  read each other's artifacts (schema contract per AGENTS.md)
- 14 unit tests

version-rust/README.md

@@ -17,7 +17,9 @@ the python tooling.
 
 | Concern | Python today | Rust plan |
 |---|---|---|
-| 7z extraction (extract_all) | 7z CLI, cp437 name repair, /var/tmp fallback | `sevenz-rust2` (pure Rust, LZMA2/PPMD/AES-256); zip via `zip` crate; rar likely still needs an external tool |
+| 7z extraction | 7z CLI, cp437 name repair, /var/tmp fallback | `sevenz-rust2` (pure Rust; LZMA/LZMA2/PPMD/AES-256 decrypt, v0.23, active) |
+| zip extraction | 7z CLI | `zip` crate |
+| RAR extraction (critical) | 7z CLI | `unrar.rs` (muja/unrar.rs — bindings to the official UnRAR library, RAR5 support, extraction only). Note: UnRAR license is freeware-not-OSI and forbids building a RAR compressor — acceptable, we only extract, and compression later is 7z-only (`sevenz-rust2` `ArchiveWriter`) anyway |
 | HTTP client | `requests` | `reqwest` (blocking first, async where the webapp needs it) |
 | sha256 (gofile website token, --hash manifest) | hashlib | `sha2` |
 | Fuzzy matching (sorter) | difflib-style ratios | `strsim` — port thresholds exactly, add unit tests |
@@ -27,8 +29,8 @@ the python tooling.
 
 ## Port order (suggested)
 
-1. `state` / `globalstore` — state.json + urls.json schemas must stay
-   backward compatible with the python versions.
+1. `state` / `globalstore` / manifest — **done**, see `src/state.rs`,
+   `src/globalstore.rs`, `src/manifest.rs` (schemas backward compatible).
 2. hosters: `gofile` (one guest account per run!), `zero807` (UA + Referer).
 3. extraction + manifest appender.
 4. catalogue / sorter (hardest logic; port the matching rules documented in