fix: always clean up temp archive on failure and fix justfile data dir path

- Wrap download/verify/extract in try/finally so .download-*.tmp is
  always deleted, even on mid-download or extraction failures
- Fix justfile build-server-cuda to use sh.voicebox.app (production path)

backend/services/cuda.py

@@ -167,8 +167,9 @@ async def _download_and_extract_archive(
         except Exception as e:
             raise RuntimeError(f"{label}: failed to fetch checksum from {sha256_url}") from e
 
-    # Stream download
+    # Stream download, verify, and extract — always clean up temp file
     downloaded = 0
+    try:
         async with client.stream("GET", url) as response:
             response.raise_for_status()
             with open(temp_path, "wb") as f:
@@ -201,8 +202,9 @@ async def _download_and_extract_archive(
                     sha256.update(data)
             actual = sha256.hexdigest()
             if actual != expected_sha:
-            temp_path.unlink()
-            raise ValueError(f"{label} integrity check failed: expected {expected_sha[:16]}..., got {actual[:16]}...")
+                raise ValueError(
+                    f"{label} integrity check failed: expected {expected_sha[:16]}..., got {actual[:16]}..."
+                )
             logger.info(f"{label}: integrity verified")
 
         # Extract (use data filter for path traversal protection on Python 3.12+)
@@ -219,8 +221,10 @@ async def _download_and_extract_archive(
             else:
                 tar.extractall(path=dest_dir)
 
-    temp_path.unlink()
         logger.info(f"{label}: extracted to {dest_dir}")
+    finally:
+        if temp_path.exists():
+            temp_path.unlink()
     return downloaded
 
 

justfile

@@ -208,7 +208,7 @@ build-server-cuda: _ensure-venv
     $env:PATH = "{{ venv_bin }};$env:PATH"; \
     & "{{ python }}" backend/build_binary.py --cuda; \
     if ($LASTEXITCODE -ne 0) { throw "build_binary.py --cuda failed with exit code $LASTEXITCODE" }; \
-    $dest = "$env:APPDATA/com.voicebox.app/backends/cuda"; \
+    $dest = "$env:APPDATA/sh.voicebox.app/backends/cuda"; \
     if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }; \
     New-Item -ItemType Directory -Path $dest -Force | Out-Null; \
     Copy-Item "backend/dist/voicebox-server-cuda/*" $dest -Recurse -Force; \