Security hardening, TS fixes, JS drag, and dynamic window resize

[edmundamoye]

Summary

• New security.ts module — centralized input sanitization, path traversal protection, binary verification, AppleScript escaping, and URL validation
• Shell injection protection — validates session IDs, project paths, and plugin names before use in shell commands or file system operations
• Whisper binary verification — checks binary is in a trusted directory (including Homebrew Cellar) and not world-writable before executing
• Marketplace hardening — validates plugin names and repo formats to prevent path traversal via install/uninstall
• JS-based window drag — replaces broken CSS -webkit-app-region: drag (incompatible with setIgnoreMouseEvents) with mousedown/mousemove IPC-based window repositioning
• Dynamic window sizing — ResizeObserver + MutationObserver measures all rendered content (including portaled popovers) and resizes the Electron window to fit, capped at screen height
• Fix all pre-existing TypeScript errors — Zustand selector types, Electron dialog option types, useRef initial values, pty-run-manager type narrowing, notification.mp3 module resolution

Test plan

• Verify drag handle moves window freely across entire screen
• Verify Option+Space toggle preserves last drag position
• Verify window dynamically resizes when conversation expands/collapses
• Verify popovers (settings, model picker) are not clipped by window boundary
• Verify npm run dist builds without TypeScript errors
• Verify marketplace install/uninstall still works
• Verify voice transcription works with Homebrew-installed whisper-cli
• Verify Open in Terminal still launches correctly