* Fix HTTP body leaks, nil pointer panics, and file handle cleanup
* Extract unzipFile loop body into unzipFileEntry helper
The unzipFile function had defer o.Close() and defer i.Close() inside
a for loop, which is a Go antipattern — defers are function-scoped and
wouldn't execute until unzipFile returned, leaving file handles open
across iterations. Extracting the per-file logic into unzipFileEntry
ensures each defer fires when that function returns, at the end of each
loop iteration.