Validate URL protocol in open-browser action

Parse the URL and reject anything that isn't http/https before passing
to xdg-open, blocking file://, javascript:// and other schemes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/actions.mjs

@@ -48,8 +48,12 @@ export const actions = {
 		params: [{ name: "url", required: true, type: "string" }],
 		policy: "queue",
 		handler: async ({ url }) => {
-			await exec("xdg-open", [url]);
-			return { opened: url };
+			const parsed = new URL(url);
+			if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+				throw new Error(`Disallowed protocol: ${parsed.protocol}`);
+			}
+			await exec('xdg-open', [parsed.href]);
+			return { opened: parsed.href };
 		},
 	},