[claude] FwLite download route ignores cancellation, so an abandoned download keeps running

POST /api/download/crdt/{serverAuthority}/{code} (ProjectRoutes.cs:72) takes no CancellationToken, and neither does CombinedProjectsService.DownloadProjectByCode -> DownloadProject -> CrdtProjectsService.CreateProject -> SyncService.ExecuteSync(true).

A client that drops its request only closes the socket. The server keeps creating the project and running the initial sync.

Concretely, lexicon.downloadAndSelectLexicon in the Platform.Bible extension aborts after DOWNLOAD_TIMEOUT_MS (platform.bible-extension/src/main.ts:411). The user sees a download failure; the lexicon can appear locally a minute later, unselected, with the Paratext project still on its old lexicon. A retry then reports AlreadyDownloaded.

Fix: thread HttpContext.RequestAborted through the route and the download stack, and clean up partial project state on cancellation (see #2292 for what a half-written project looks like). If initial sync can't be cancelled safely, drop the ineffective abort instead and pick a timeout that covers supported project sizes.

The sign-in route already does this, so the pattern exists.

Pre-existing; surfaced during review of #2585.

Start at ProjectRoutes.cs:72 and compare the sign-in route's cancellation handling, then trace DownloadProjectByCode through DownloadProject, CrdtProjectsService.CreateProject, and SyncService.ExecuteSync(true). Review #2292 for partial project state and platform.bible-extension/src/main.ts:411 for the client timeout. Done means an abandoned request stops safely without leaving unusable state, or the timeout behavior is intentionally corrected if sync cannot be cancelled safely.