fix: add URL encoding and remove unused import

- Add encodeURIComponent() for project, version, and filename parameters in downloadUrl to prevent XSS and URL breakage
- Remove unused formatDateTime import

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

app/api/apks/route.ts

@@ -1,6 +1,6 @@
 // app/api/apks/route.ts
 import { NextResponse } from 'next/server';
-import { getApks, formatDateTime } from '@/lib/fs-utils';
+import { getApks } from '@/lib/fs-utils';
 
 export async function GET(request: Request) {
   const { searchParams } = new URL(request.url);
@@ -20,7 +20,7 @@ export async function GET(request: Request) {
     const apksWithUrls = apks.map(apk => ({
       ...apk,
       modifiedAt: apk.modifiedAt.toISOString(),
-      downloadUrl: `/api/download?project=${project}&version=${version}&filename=${apk.name}`,
+      downloadUrl: `/api/download?project=${encodeURIComponent(project)}&version=${encodeURIComponent(version)}&filename=${encodeURIComponent(apk.name)}`,
     }));
     return NextResponse.json(apksWithUrls);
   } catch (error) {