fix: harden splash screen timer/listener leaks and origin validation

- SplashScreen: track all scheduled timers, clear on unmount (prevents ghost callbacks)
- SplashScreen: manage video pause listener lifecycle (add once, remove when done)
- SplashScreen: clear videoTimeUpdateInterval on unmount
- Chat.vue: validate postMessage origin before accepting ready signal
- App.vue: remove shadowed variable re-declaration in onKeyDown

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

neode-ui/src/App.vue

@@ -142,8 +142,6 @@ function onKeyDown(e: KeyboardEvent) {
   }
   // 's' key activates screensaver when authenticated (skip if typing in input)
   if (e.key === 's' || e.key === 'S') {
-    const target = e.target as HTMLElement
-    const isInput = target.tagName === 'INPUT' || target.tagName === 'TEXTAREA' || target.isContentEditable
     if (!isInput && appStore.isAuthenticated && !screensaverStore.isActive) {
       e.preventDefault()
       screensaverStore.activate()