fix: address all final review findings for Phase 3

- CRITICAL: Fix command injection in discoveryService (execFile instead
  of exec, path validation regex)
- CRITICAL: Add Zod validation on discover API endpoint
- HIGH: Add Zod validation on discover/approve endpoint
- HIGH: Add array length limits to import schema (1000/100/100)
- HIGH: Fix theme broadcast echo loop (setTimeout vs queueMicrotask)
- MEDIUM: Singleton BroadcastChannel instead of create-per-send
- MEDIUM: Exclude sensitive APIs from service worker cache
- MEDIUM: Fix TypeScript cast errors in exportService tests

src/lib/stores/theme.svelte.ts

@@ -151,10 +151,10 @@ class ThemeStore {
 		this.primaryHue = values.primaryHue;
 		this.primarySaturation = values.primarySaturation;
 		this.backgroundType = values.backgroundType;
-		// Re-enable on next microtask so the effect reads suppressBroadcast=true
-		queueMicrotask(() => {
+		// Use setTimeout to ensure all Svelte 5 effects have fired before re-enabling broadcast
+		setTimeout(() => {
 			this.#suppressBroadcast = false;
-		});
+		}, 100);
 	}
 
 	/**