fix: address all final review findings for Phase 3

- CRITICAL: Fix command injection in discoveryService (execFile instead
  of exec, path validation regex)
- CRITICAL: Add Zod validation on discover API endpoint
- HIGH: Add Zod validation on discover/approve endpoint
- HIGH: Add array length limits to import schema (1000/100/100)
- HIGH: Fix theme broadcast echo loop (setTimeout vs queueMicrotask)
- MEDIUM: Singleton BroadcastChannel instead of create-per-send
- MEDIUM: Exclude sensitive APIs from service worker cache
- MEDIUM: Fix TypeScript cast errors in exportService tests

src/service-worker.ts

@@ -50,6 +50,13 @@ self.addEventListener('fetch', (event: FetchEvent) => {
 	// Skip cross-origin requests
 	if (url.origin !== self.location.origin) return;
 
+	// Sensitive API paths: never cache, always go to network
+	const sensitiveApiPrefixes = ['/api/users/', '/api/admin/', '/api/auth/'];
+	if (sensitiveApiPrefixes.some((prefix) => url.pathname.startsWith(prefix))) {
+		event.respondWith(fetch(request));
+		return;
+	}
+
 	// API calls: network-first with cache fallback
 	if (url.pathname.startsWith('/api/')) {
 		event.respondWith(networkFirst(request));