Restrict WebView command bridge

[3em0]

Summary

• Replace WebView-controlled shell command strings with native-side allowlisted command IDs.
• Add non-shell ProcessBuilder execution for WebView-triggered commands.
• Restrict terminal shortcut, platform, and tool bridge inputs so unknown WebView values do not reach shell execution paths.
• Validate saved platform IDs before boot auto-start to avoid reusing unsafe persisted marker values.

Fixes #136

Testing

• git diff --check
• Source-level search confirmed old writeToTerminal / runInNewSession public bridge methods are no longer exposed and runtime version queries use command IDs.

Not Run

• npm run build: blocked because node_modules was absent; npm ci failed on the NAS workspace with EIO: symlink ... node_modules/.bin/parser, and the available Node.js is v18 while this project requires Node 20.19+ or 22.12+ for Vite.
• ./gradlew testDebugUnitTest: blocked because this environment has no Java/JDK (JAVA_HOME unset and no java on PATH).