fix(miniapp): allow strict runtime downloads

[nonoqing]

Summary

• allow user-triggered downloads from market-strict MiniApp iframes
• keep the strict runtime sandbox otherwise unchanged
• update the focused sandbox regression test

Why

Market MiniApps render inside a sandboxed iframe. The strict profile previously used only allow-scripts, so the webview blocked the standard Blob URL + <a download> flow even when the MiniApp generated the file locally. This made result-card downloads fail while the non-strict runtime already supported downloads.

Security boundary

This adds only allow-downloads. The strict iframe still does not receive allow-same-origin, forms, modals, popups, or filesystem access.

Verification

• pnpm --dir src/web-ui run test:run src/app/scenes/miniapps/components/MiniAppRunner.test.tsx (1 passed)
• pnpm --dir src/web-ui run gen:types (36 Rust export tests passed)
• pnpm run check:web
• local desktop dev HMR confirmed the strict iframe receives sandbox="allow-scripts allow-downloads"

Remote workspace, Remote Control, Peer Device Mode, and Detached Dispatch were not exercised; this change is limited to the local Web UI iframe sandbox attribute.

AI assistance

AI-assisted change, locally verified with the focused regression test and Web UI checks listed above.