fix: address all final review findings for Phase 3

- CRITICAL: Fix command injection in discoveryService (execFile instead
  of exec, path validation regex)
- CRITICAL: Add Zod validation on discover API endpoint
- HIGH: Add Zod validation on discover/approve endpoint
- HIGH: Add array length limits to import schema (1000/100/100)
- HIGH: Fix theme broadcast echo loop (setTimeout vs queueMicrotask)
- MEDIUM: Singleton BroadcastChannel instead of create-per-send
- MEDIUM: Exclude sensitive APIs from service worker cache
- MEDIUM: Fix TypeScript cast errors in exportService tests

src/lib/utils/validators.ts

@@ -240,9 +240,9 @@ const importSettingsSchema = z.object({
 export const importDataSchema = z.object({
 	version: z.string(),
 	exportedAt: z.string(),
-	apps: z.array(importAppSchema),
-	boards: z.array(importBoardSchema),
-	groups: z.array(importGroupSchema),
+	apps: z.array(importAppSchema).max(1000),
+	boards: z.array(importBoardSchema).max(100),
+	groups: z.array(importGroupSchema).max(100),
 	settings: importSettingsSchema
 });